Alert rule for windows commands like ping


I created a rule to detect the ping command but it doesn't work for me.

Rule:"PING.exe" and process.state:"running"

The same rule with for example the powershell.exe works.


This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.