Hub configuration

Name: Ping Hex IP
Author: sigmahq

More info

Ping Hex IP Detection Scenario by sigmahq | CrowdSec Hub

« Ping Hex IP »
v0.2 by sigmahq / proc_creation_win_ping_hex_ip
Attack scenariowindowsNot spoofableLow confidence

Detects a ping command that uses a hex encoded IP address

Installation

cscli scenarios install sigmahq/proc_creation_win_ping_hex_ip

YAML Configuration

1type: trigger
2name: sigmahq/proc_creation_win_ping_hex_ip
3description: |
4  Detects a ping command that uses a hex encoded IP address
5filter: |
6  (evt.Meta.service == 'sysmon' && evt.Parsed.EventID == '1') && (evt.Parsed.Image endsWith '\\ping.exe' && evt.Parsed.CommandLine contains '0x')
7blackhole: 2m
8#status: test
9labels:
10  service: windows
11  confidence: 1
12  spoofable: 0
13  classification:
14   - attack.t1140
15   - attack.t1027
16
17  label: "Ping Hex IP"
18  behavior : "windows:audit"
19  remediation: false
20
21scope:
22  type: ParentProcessId
23  expression: evt.Parsed.ParentProcessId
24
25

Hub configuration

« Ping Hex IP »v0.2 by sigmahq / proc_creation_win_ping_hex_ipAttack scenariowindowsNot spoofableLow confidenceMITRE:t1140MITRE:t1027

« Ping Hex IP »
v0.2 by sigmahq / proc_creation_win_ping_hex_ip
Attack scenariowindowsNot spoofableLow confidence