Windows Process Creation: Suspicious for/foreach Scan Loop with nslookup or ping

title: "Windows Process Creation: Suspicious for/foreach Scan Loop with nslookup or ping"
id: cafdc360-51ee-4bea-b0cd-f557174b4546
status: test
description: This rule flags Windows process creation where the command line contains a looping construct ("for " or "foreach ") and also includes network discovery tools ("nslookup" or "ping"). Iterative scanning for reachable hosts is a common step toward identifying targets for lateral movement. The detection relies on process command-line telemetry capturing both the loop and the network tool usage in the same execution.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1018/T1018.md
  - https://ss64.com/nt/for.html
  - https://ss64.com/ps/foreach-object.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_network_scan_loop.yml
author: frack113, Huntrule Team
date: 2022-03-12
tags:
  - attack.execution
  - attack.t1059
  - attack.discovery
  - attack.t1018
logsource:
  category: process_creation
  product: windows
detection:
  selection_loop:
    CommandLine|contains:
      - "for "
      - "foreach "
  selection_tools:
    CommandLine|contains:
      - nslookup
      - ping
  condition: all of selection_*
falsepositives:
  - Legitimate script
level: medium
license: DRL-1.1
related:
  - id: f8ad2e2c-40b6-4117-84d7-20b89896ab23
    type: derived