Ping to localhost from an uncommon, unsigned parent process

Cortex XDR Analytics Alert Reference by Alert name

Product
Cortex XDR
Last date published
2024-06-04
Category
Analytics Alert Reference
Order
Alert name

Synopsis

Activation Period

14 Days

Training Period

30 Days

Test Period

N/A (single event)

Deduplication Period

1 Hour

Required Data

  • Requires:
    • XDR Agent

Detection Modules

ATT&CK Tactic

Defense Evasion (TA0005)

ATT&CK Technique

Virtualization/Sandbox Evasion (T1497)

Severity

Informational

Description

Ping is often used by malware and attackers to delay the execution of suspicious commands in sandbox environments.

Attacker's Goals

Use ping as an easy way to wait to try and evade detection between executions.

Investigative actions

  • Validate if the executing process is malicious.