Internet reachability probe against a public test endpoint

Siemphony@siemphonylowT1016.001unverified

Matches AN1015's Windows shape: one of the built-in reachability utilities (ping, tracert, pathping, curl) or the PowerShell Test-NetConnection / Test-Connection cmdlets invoked with a destination that only exists to prove the host can reach the Internet. Both halves are required, because the utility on its own is ordinary internal troubleshooting and the destination string on its own appears in any script that mentions a public site — it is the pairing that says "confirm this box can talk to the outside world", which is the discovery step MITRE describes before a C2 attempt. The destination list is MITRE's DestinationIP knob, populated here with the public resolvers, the Microsoft NCSI endpoints and the what-is-my-IP services an operator typically reaches for; an adversary who probes their own domain instead matches nothing, so the list is the first thing to extend per environment. Two limits are structural rather than tunable. Bare `Test-NetConnection` with no argument tests internetbeacon.msedge.net implicitly and carries no destination on the command line, so it is invisible here; and commands typed into an already-running interactive console never reach a process-creation event at all. The brief's Security 5156/5157 log source was not used: the Filtering Platform records a socket, not a command line or a hostname, so every outbound connection on the estate looks identical to a connectivity test there. This rule is written in the Sysmon EventID 1 vocabulary (Image, CommandLine); where the same category is fed by Security EventID 4688 instead, that channel needs *Audit Process Creation* and the separate *Include command line in process creation events* policy before CommandLine is populated at all, and a field mapping to NewProcessName first. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0357, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where (((FolderPath endswith "\\ping.exe" or FolderPath endswith "\\tracert.exe" or FolderPath endswith "\\pathping.exe" or FolderPath endswith "\\curl.exe") or ((FolderPath endswith "\\powershell.exe" or FolderPath endswith "\\pwsh.exe") and (ProcessCommandLine contains "Test-NetConnection" or ProcessCommandLine contains "Test-Connection"))) and (ProcessCommandLine contains "8.8.8.8" or ProcessCommandLine contains "8.8.4.4" or ProcessCommandLine contains "1.1.1.1" or ProcessCommandLine contains "9.9.9.9" or ProcessCommandLine contains "208.67.222.222" or ProcessCommandLine contains "google.com" or ProcessCommandLine contains "example.com" or ProcessCommandLine contains "msftconnecttest.com" or ProcessCommandLine contains "msftncsi.com" or ProcessCommandLine contains "icanhazip.com" or ProcessCommandLine contains "ifconfig.me" or ProcessCommandLine contains "ipinfo.io" or ProcessCommandLine contains "api.ipify.org" or ProcessCommandLine contains "checkip.amazonaws.com"))

Splunk · SPL

Run this as a search.

index=* (((Image="*\\ping.exe" OR Image="*\\tracert.exe" OR Image="*\\pathping.exe" OR Image="*\\curl.exe") OR ((Image="*\\powershell.exe" OR Image="*\\pwsh.exe") AND (CommandLine="*Test-NetConnection*" OR CommandLine="*Test-Connection*"))) AND (CommandLine="*8.8.8.8*" OR CommandLine="*8.8.4.4*" OR CommandLine="*1.1.1.1*" OR CommandLine="*9.9.9.9*" OR CommandLine="*208.67.222.222*" OR CommandLine="*google.com*" OR CommandLine="*example.com*" OR CommandLine="*msftconnecttest.com*" OR CommandLine="*msftncsi.com*" OR CommandLine="*icanhazip.com*" OR CommandLine="*ifconfig.me*" OR CommandLine="*ipinfo.io*" OR CommandLine="*api.ipify.org*" OR CommandLine="*checkip.amazonaws.com*"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (((TO_LOWER(process.executable) LIKE "*\\\\ping.exe" OR TO_LOWER(process.executable) LIKE "*\\\\tracert.exe" OR TO_LOWER(process.executable) LIKE "*\\\\pathping.exe" OR TO_LOWER(process.executable) LIKE "*\\\\curl.exe") OR ((TO_LOWER(process.executable) LIKE "*\\\\powershell.exe" OR TO_LOWER(process.executable) LIKE "*\\\\pwsh.exe") AND (TO_LOWER(process.command_line) LIKE "*test-netconnection*" OR TO_LOWER(process.command_line) LIKE "*test-connection*"))) AND (TO_LOWER(process.command_line) LIKE "*8.8.8.8*" OR TO_LOWER(process.command_line) LIKE "*8.8.4.4*" OR TO_LOWER(process.command_line) LIKE "*1.1.1.1*" OR TO_LOWER(process.command_line) LIKE "*9.9.9.9*" OR TO_LOWER(process.command_line) LIKE "*208.67.222.222*" OR TO_LOWER(process.command_line) LIKE "*google.com*" OR TO_LOWER(process.command_line) LIKE "*example.com*" OR TO_LOWER(process.command_line) LIKE "*msftconnecttest.com*" OR TO_LOWER(process.command_line) LIKE "*msftncsi.com*" OR TO_LOWER(process.command_line) LIKE "*icanhazip.com*" OR TO_LOWER(process.command_line) LIKE "*ifconfig.me*" OR TO_LOWER(process.command_line) LIKE "*ipinfo.io*" OR TO_LOWER(process.command_line) LIKE "*api.ipify.org*" OR TO_LOWER(process.command_line) LIKE "*checkip.amazonaws.com*"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <!-- 2 rules: the Sigma condition ORs across different fields,       which one rule cannot express. Any one matching is a hit. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(\\ping\.exe$|\\tracert\.exe$|\\pathping\.exe$|\\curl\.exe$)</field>    <field name="CommandLine" type="pcre2">(?i)(8\.8\.8\.8|8\.8\.4\.4|1\.1\.1\.1|9\.9\.9\.9|208\.67\.222\.222|google\.com|example\.com|msftconnecttest\.com|msftncsi\.com|icanhazip\.com|ifconfig\.me|ipinfo\.io|api\.ipify\.org|checkip\.amazonaws\.com)</field>    <description>Internet reachability probe against a public test endpoint (1/2)</description>    <mitre>      <id>T1016.001</id>    </mitre>  </rule>   <rule id="100001" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(\\powershell\.exe$|\\pwsh\.exe$)</field>    <field name="CommandLine" type="pcre2">(?i)(Test-NetConnection|Test-Connection)</field>    <field name="CommandLine" type="pcre2">(?i)(8\.8\.8\.8|8\.8\.4\.4|1\.1\.1\.1|9\.9\.9\.9|208\.67\.222\.222|google\.com|example\.com|msftconnecttest\.com|msftncsi\.com|icanhazip\.com|ifconfig\.me|ipinfo\.io|api\.ipify\.org|checkip\.amazonaws\.com)</field>    <description>Internet reachability probe against a public test endpoint (2/2)</description>    <mitre>      <id>T1016.001</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: low
Category: discovery_recon
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 34daedcd-15b5-44d1-9ab5-e27dc5d1b61b

ATT&CKT1016.001

T1016.001Internet Connection Discovery

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessondiscovery recon

discovery reconAI draft — unreviewed

01 · What this rule detects

One process-creation event where a reachability tool is invoked with a public test destination on its command line. The pairing is the whole rule. ping.exe on its own is ordinary troubleshooting; 8.8.8.8 on its own turns up in any script that mentions a resolver. Together they say "confirm this box can talk to the outside world" — the step AN1015 describes before a C2 attempt.

02 · Telemetry you need

category: process_creation / product: windows, copied from AN1015's Sysmon EventID 1 entry, and the rule is written in that vocabulary (Image, CommandLine). If your process_creation feed is Security 4688 instead, it needs Audit Process Creation plus the separate Include command line in process creation events policy — neither is on by default or in the MS/CIS baselines — and a field mapping to NewProcessName before anything matches.
AN1015 also offers Security 5156/5157. That source was rejected: the Filtering Platform records a socket, not a hostname or a command line, so a connectivity test looks identical to every other outbound connection. All four backends render the rule as written.

03 · How the logic works

Condition is (selection_native or selection_cmdlet) and selection_target. selection_native is Image|endswith on ping.exe, tracert.exe, pathping.exe, curl.exe. selection_cmdlet requires Image|endswith powershell.exe or pwsh.exe and CommandLine|contains Test-NetConnection or Test-Connection. selection_target is CommandLine|contains over fourteen destinations: the public resolvers, the Microsoft NCSI endpoints, and the what-is-my-IP services (icanhazip.com, ifconfig.me, api.ipify.org, checkip.amazonaws.com). That list is MITRE's DestinationIP knob, populated here by the pipeline — MITRE named the knob, the fourteen values are ours. Four limits, all worth knowing before a quiet result reassures you: - Bare Test-NetConnection implicitly tests internetbeacon.msedge.net and puts no destination on the command line, so it is invisible here. - Commands typed into an already-running console produce no process creation. - In Windows PowerShell 5.1 curl and wget are aliases for Invoke-WebRequest, so curl https://ifconfig.me at a PowerShell prompt creates no curl.exe and names no cmdlet the rule looks for. The same string in cmd.exe does fire. The review called this the most likely real-world miss. - contains on bare literals is a substring test: '1.1.1.1' also matches '11.1.1.10', and 'google.com' matches 'notgoogle.com'.

04 · Common false positives

Helpdesk troubleshooting dominates, by a wide margin: ping 8.8.8.8 and tracert 8.8.8.8 are the first two commands typed in essentially every connectivity investigation, and the logic cannot separate them from the technique. Behind that sit logon scripts, SCCM task sequences and monitoring wrappers that probe a public endpoint before downloading content; NCSI diagnostics run by hand against Microsoft's own endpoints; and build agents or VPN clients curling api.ipify.org to record an egress address. level: low is calibrated to that first entry rather than to the technique's severity.

05 · Detection maturity

tier_1: , the lowest tier, and it stays there until it has been run against real data. UNVERIFIED: derived from DET0357 and never executed against a log line.
tier_2: here is cheap — a week of process_creation events ranked by user and parent will show you what fraction is your own support desk, and whether low is generous.
tier_3: means the aggregation MITRE actually described, which is not a Sigma rule.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Rewrite selection_target for your estate before anything else — an operator who probes their own domain matches nothing, so that list is where coverage lives and dies. Use MITRE's UserContext knob to exclude the service accounts behind your task sequences and monitoring agents; that removes the scheduled noise without narrowing the utility list. Then filter on ParentImage: a probe parented to a script host, an Office process or a fresh service is a different proposition from one typed into an interactive cmd.exe, and this rule has no other way to tell them apart. Adding Invoke-WebRequest, Invoke-RestMethod, iwr and irm to selection_cmdlet closes the alias gap cheaply, since selection_target still gates every match. MITRE's TimeWindow knob — clustering probes with execution inside 60 seconds — has no Sigma expression; it belongs in downstream correlation.

Declared by the author

Helpdesk and administrator troubleshooting, where ping 8.8.8.8 and tracert 8.8.8.8 are the first two commands typed in essentially every connectivity investigation. On any estate with a support desk this is the highest-volume match by a wide margin and it will look exactly like the technique.
Logon scripts, SCCM task sequences and monitoring-agent wrappers that shell out to ping or curl a public endpoint to confirm Internet access before downloading content, which fires on a schedule on every host that runs them.
Windows NCSI diagnostics, where a technician curls www.msftconnecttest.com by hand to work out why the network icon shows no Internet — the endpoint is Microsoft's own and is in the destination list precisely because adversaries use it too.
Build agents, deployment scripts and VPN client checks that call curl against api.ipify.org or checkip.amazonaws.com to record the current egress address for a firewall allowlist.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1016.001, evaluated against their process_creation events.

Share this rule

/u/siemphony/34daedcd-15b5-44d1-9ab5-e27dc5d1b61b

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Internet reachability probe against a public test endpoint

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it