Potentially Suspicious Ping/Copy Command Combination
Detects a potentially suspicious one-liner command combining 'ping' and 'copy' within a 'cmd.exe' process. This combination is often used by malware for purposes such as network reconnaissance followed by data staging or exfiltration, or as a defense evasion technique by leveraging common system utilities in an unusual manner. The rule specifically looks for the presence of 'ping' and 'copy ' along with either the '-n' (count) or '-y' (yes to overwrite) flags in the command line.
Sigma
