Windows Process Creation: Suspicious for/foreach Scan Loop with nslookup or ping
Alerts on Windows command lines using for/foreach loops that also run nslookup or ping, consistent with host scanning.
- Product
- windows
- Category
- process_creation
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2022-03-12
- Updated
- 2026-07-30
ATT&CK techniques
Execution → DiscoveryRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows process creation where the command line contains a looping construct ("for " or "foreach ") and also includes network discovery tools ("nslookup" or "ping"). Iterative scanning for reachable hosts is a common step toward identifying targets for lateral movement. The detection relies on process command-line telemetry capturing both the loop and the network tool usage in the same execution.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1018/T1018.md
- ss64.comhttps://ss64.com/nt/for.html
- ss64.comhttps://ss64.com/ps/foreach-object.html
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_network_scan_loop.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Creation: Suspicious for/foreach Scan Loop with nslookup or ping"
id: cafdc360-51ee-4bea-b0cd-f557174b4546
status: test
description: This rule flags Windows process creation where the command line contains a looping construct ("for " or "foreach ") and also includes network discovery tools ("nslookup" or "ping"). Iterative scanning for reachable hosts is a common step toward identifying targets for lateral movement. The detection relies on process command-line telemetry capturing both the loop and the network tool usage in the same execution.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1018/T1018.md
- https://ss64.com/nt/for.html
- https://ss64.com/ps/foreach-object.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_network_scan_loop.yml
author: frack113, Huntrule Team
date: 2022-03-12
tags:
- attack.execution
- attack.t1059
- attack.discovery
- attack.t1018
logsource:
category: process_creation
product: windows
detection:
selection_loop:
CommandLine|contains:
- "for "
- "foreach "
selection_tools:
CommandLine|contains:
- nslookup
- ping
condition: all of selection_*
falsepositives:
- Legitimate script
level: medium
license: DRL-1.1
related:
- id: f8ad2e2c-40b6-4117-84d7-20b89896ab23
type: derived