LoFP / unlikely, because no sane admin pings ip addresses in a hexadecimal form

Techniques

• t1027
• t1140

Sample rules

Ping Hex IP

• source: sigma
• technicques:
  • t1027
  • t1140

Description

Detects a ping command that uses a hex encoded IP address

Detection logic

condition: selection
selection:
  CommandLine|re: 0x[a-fA-F0-9]{8}
  Image|endswith: \ping.exe