Analytics BIOC Informational
✕

Ping to localhost from an uncommon, unsigned parent process

Ping is often used by malware and attackers to delay the execution of suspicious commands in sandbox environments.

Module:
Platform Analytics
Data source:
XDR Agent
ATT&CK tactics: Defense Evasion (TA0005)
ATT&CK techniques: Virtualization/Sandbox Evasion (T1497)
Attacker's goals:

Use ping as an easy way to wait to try and evade detection between executions.

Investigative actions:

Validate if the executing process is malicious.

Test period:
N/A (single event)
Deduplication:
1 Hour