CmdID

CmdID / Commands

nping

Network packet generation tool/ping utility. tldr-pages

On several platforms 1 Sigma rule name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Several platforms

from tldr-pages, CC BY 4.0

Ping a specified host using ICMP if the user is allowed to, otherwise using TCP

nping example.comIdentify

Trips 1 Sigma rule: lowLinux Network Service Scanning Tools Execution by Alejandro Ortuno, oscd.community, Georg Lauenstein (sure[secure])

Ping a specified host using ICMP assuming that the user is allowed to do so

nping --icmp --privileged example.comIdentify

Trips 1 Sigma rule: lowLinux Network Service Scanning Tools Execution by Alejandro Ortuno, oscd.community, Georg Lauenstein (sure[secure])

Ping a specified host using UDP

nping --udp example.comIdentify

Trips 1 Sigma rule: lowLinux Network Service Scanning Tools Execution by Alejandro Ortuno, oscd.community, Georg Lauenstein (sure[secure])

Ping a specified host on a given port using TCP

nping --tcp --dest-port 443 example.comIdentify

Trips 1 Sigma rule: lowLinux Network Service Scanning Tools Execution by Alejandro Ortuno, oscd.community, Georg Lauenstein (sure[secure])

Ping a certain number of times

nping --count 10 example.comIdentify

Trips 1 Sigma rule: lowLinux Network Service Scanning Tools Execution by Alejandro Ortuno, oscd.community, Georg Lauenstein (sure[secure])

Wait a certain amount of time between each ping

nping --delay 5s example.comIdentify

Trips 1 Sigma rule: lowLinux Network Service Scanning Tools Execution by Alejandro Ortuno, oscd.community, Georg Lauenstein (sure[secure])

Send the request over a specified interface

nping --interface eth0 example.comIdentify

Trips 1 Sigma rule: lowLinux Network Service Scanning Tools Execution by Alejandro Ortuno, oscd.community, Georg Lauenstein (sure[secure])

Ping an IP range

nping 10.0.0.1-10Identify

Trips 1 Sigma rule: lowLinux Network Service Scanning Tools Execution by Alejandro Ortuno, oscd.community, Georg Lauenstein (sure[secure])

What detects it

Sigma process creation rules that name nping
lowLinux Network Service Scanning Tools ExecutionAlejandro Ortuno, oscd.community, Georg Lauenstein (sure[secure])