Windows process creation: suspicious ping wait followed by del file deletion
Flags cmd/powershell command lines that use ping -n with Nul redirection followed by Del /f /q to delete a file.
- Product
- windows
- Category
- process_creation
- Author
- Ilya Krestinichev (SigmaHQ), DRL 1.1
- Published
- 2022-11-03
- Updated
- 2026-07-31
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies Windows command lines that combine a ping with a short delay and a subsequent del operation to remove a targeted file. The behavior matters because attackers may use command chaining to delete artifacts related to initial execution or staging while delaying actions. It relies on process creation telemetry, specifically command-line content containing both ping and del along with common ping and deletion parameters.
Reporting behind it
- blog.sygnia.cohttps://blog.sygnia.co/kaseya-ransomware-supply-chain-attack
- media.kasperskycontenthub.comhttps://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2022/06/23093553/Common-TTPs-of-the-modern-ransomware_low-res.pdf
- acronis.comhttps://www.acronis.com/en-us/blog/posts/lockbit-ransomware/
- symantec-enterprise-blogs.security.comhttps://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/blackbyte-exbyte-ransomware
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_cmd_ping_del_combined_execution.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows process creation: suspicious ping wait followed by del file deletion"
id: 10afd42e-4d6f-4e92-b482-ea584055900c
status: test
description: This rule identifies Windows command lines that combine a ping with a short delay and a subsequent del operation to remove a targeted file. The behavior matters because attackers may use command chaining to delete artifacts related to initial execution or staging while delaying actions. It relies on process creation telemetry, specifically command-line content containing both ping and del along with common ping and deletion parameters.
references:
- https://blog.sygnia.co/kaseya-ransomware-supply-chain-attack
- https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2022/06/23093553/Common-TTPs-of-the-modern-ransomware_low-res.pdf
- https://www.acronis.com/en-us/blog/posts/lockbit-ransomware/
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/blackbyte-exbyte-ransomware
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_cmd_ping_del_combined_execution.yml
author: Ilya Krestinichev, Huntrule Team
date: 2022-11-03
modified: 2024-03-05
tags:
- attack.stealth
- attack.t1070.004
logsource:
category: process_creation
product: windows
detection:
selection_count:
CommandLine|contains|windash: " -n "
selection_nul:
CommandLine|contains: Nul
selection_del_param:
CommandLine|contains|windash:
- " -f "
- " -q "
selection_all:
CommandLine|contains|all:
- ping
- "del "
condition: all of selection_*
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 54786ddc-5b8a-11ed-9b6a-0242ac120002
type: derived