Suspicious Command Execution with Ping and File Deletion

nomit vyas@xoxo

•updated Jun 24, 2026•0•0•4

Detects suspicious command-line activity involving 'cmd.exe' executing 'ping' to the loopback address (127.0.0.1) combined with an ampersand ('&') and a file deletion command ('del', 'delete', or 'erase'). This pattern is often indicative of an attacker attempting to test network connectivity or bypass security controls while also performing cleanup or destructive actions.