Suspicious Command Execution with Ping and File Deletion

nomit vyas@xoxo

•updated Jun 24, 2026•0•0•3

Detects suspicious command-line activity involving 'cmd.exe' executing 'ping' to localhost (127.0.0.1) combined with a file deletion command ('del', 'delete', or 'erase') using the '&' operator. This pattern can indicate an attempt to test network connectivity before or after performing a destructive action, often seen in malware or adversary scripts.