Ping Hex IP

Title: Ping Hex IP
Status: test
Description:Detects a ping command that uses a hex encoded IP address
References:
  -https://github.com/vysecurity/Aggressor-VYSEC/blob/0d61c80387b9432dab64b8b8a9fb52d20cfef80e/ping.cna
  -https://twitter.com/vysecurity/status/977198418354491392
Author: Florian Roth (Nextron Systems)
Date: 2018-03-23
modified:2025-10-17
Tags:

• -'attack.stealth'
• -'attack.t1140'
• -'attack.t1027'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    Image|endswith: '\ping.exe'
    CommandLine|re: '0x[a-fA-F0-9]{8}'
  condition:selection
Falsepositives:
  -Unlikely, because no sane admin pings IP addresses in a hexadecimal form
Level: high