Ping Sleep Batch Command for Evasion
This analytic identifies the execution of `ping` commands with specific arguments that indicate an attempt to delay malicious code execution. It looks for `ping` commands containing `-n` (number of echo requests), `Nul` (redirecting output to NUL device), and redirection operators (`>`, `&>`). This technique is often used by adversaries to evade detection or sandbox analysis by introducing delays, making it harder to detect and analyze their activities.
Splunk (SPL)
