Windows process creation: ping delay followed by del file deletion

title: "Windows process creation: ping delay followed by del file deletion"
id: 10afd42e-4d6f-4e92-b482-ea584055900c
status: test
description: This rule matches Windows command lines that include a ping delay (-n), a redirected NUL output (Nul), and a subsequent file deletion using Del with force and quiet parameters (-f and -q). Attackers and ransomware operators may use this ping/del chaining to pause execution and then remove the targeted file to hinder recovery or analysis. Telemetry required is Windows process creation events with the full CommandLine for the initiating process.
references:
  - https://blog.sygnia.co/kaseya-ransomware-supply-chain-attack
  - https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2022/06/23093553/Common-TTPs-of-the-modern-ransomware_low-res.pdf
  - https://www.acronis.com/en-us/blog/posts/lockbit-ransomware/
  - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/blackbyte-exbyte-ransomware
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_cmd_ping_del_combined_execution.yml
author: Ilya Krestinichev, Huntrule Team
date: 2022-11-03
modified: 2024-03-05
tags:
  - attack.stealth
  - attack.t1070.004
logsource:
  category: process_creation
  product: windows
detection:
  selection_count:
    CommandLine|contains|windash: " -n "
  selection_nul:
    CommandLine|contains: Nul
  selection_del_param:
    CommandLine|contains|windash:
      - " -f "
      - " -q "
  selection_all:
    CommandLine|contains|all:
      - ping
      - "del "
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 54786ddc-5b8a-11ed-9b6a-0242ac120002
    type: derived