Obfuscated IP Address Usage in Command Line

SigmaHQ Detections@sigmaHQ

•updated Sep 2, 2024•0•16

This rule detects attempts to use obfuscated or encoded IP addresses (e.g., hexadecimal, octal, or URL-encoded formats) within command-line arguments of `ping.exe` or `arp.exe`. This technique can be used by adversaries to evade simple string-based detections or to obscure their network communication targets.