administrators, network operators, scripts, and software installers may legitimately use ping commands as a simple delay mechanism between commands or operations. review the full command line, parent process, user context, and surrounding activity to determine whether the execution is expected. update the filter macro to exclude known legitimate command patterns or processes in your environment.

splunk

Techniques

Sample rules

Ping Sleep Batch Command

source: splunk
technicques:

Description

The following analytic identifies the use of ping commands as a delay or sleep mechanism within batch-style command execution. It leverages process creation telemetry from Endpoint Detection and Response (EDR) agents and examines process and parent process command-line fields for ping commands that specify a count and are chained with additional commands using command separators or redirection operators. While execution of the command may generate individual process creation events, such as a separate ping.exe process, this analytic specifically focuses on the original command string passed to a command interpreter, such as cmd.exe /c, that combines the ping-based delay with subsequent command execution. Adversaries may use ping as an alternative to explicit sleep or timeout commands to introduce execution delays, potentially evading automated analysis, sandboxing, or behavior-based detection. Because ping is commonly used for legitimate network troubleshooting, findings should be reviewed in the context of the complete command line, parent process, user, and commands executed before or after the delay.

Detection logic


| tstats `security_content_summariesonly`
  count min(_time) as firstTime
        max(_time) as lastTime

FROM datamodel=Endpoint.Processes WHERE
(
    Processes.parent_process= "*ping*"
    Processes.parent_process IN (
        "*-n*",
        "*/n*"
    )
    Processes.parent_process IN (
        "*& *",
        "*&amp;*",
        "*&C:*",
        "*&gt;*",
        "*>*",
        "*
|
|*"
    )
)
OR
(
    (
        Processes.process_name= "ping.exe"
        OR
        Processes.original_file_name= "ping.exe"
    )
    Processes.process IN (
        "*-n*",
        "*/n*"
    )
    Processes.process IN (
        "*& *",
        "*&amp;*",
        "*&C:*",
        "*&gt;*",
        "*>*",
        "*
|
|*"
    )
)

BY Processes.action Processes.dest Processes.original_file_name
   Processes.parent_process Processes.parent_process_exec
   Processes.parent_process_guid Processes.parent_process_id
   Processes.parent_process_name Processes.parent_process_path
   Processes.process Processes.process_exec Processes.process_guid
   Processes.process_hash Processes.process_id Processes.process_integrity_level
   Processes.process_name Processes.process_path Processes.user
   Processes.user_id Processes.vendor_product


| `drop_dm_object_name("Processes")`

| `security_content_ctime(firstTime)`

| `security_content_ctime(lastTime)`

| `ping_sleep_batch_command_filter`