« Potential Privilege Escalation via a Parent/Child Process Sequence ICMP Redirect Message from Internal Host »
Elastic Docs ›Elastic Security [8.19] ›Downloadable rule update v8.19.27

Potential ICMP Tunneling Activity to the Internet

edit
IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

Potential ICMP Tunneling Activity to the Internet

edit

Identifies ICMP Echo traffic from an internal host to an external destination with a larger-than-typical transaction size. Covert channels and ICMP tunneling tools embed data in echo payloads that exceed normal OS ping behavior, which is usually limited to small fixed-size packets.

Rule type: new_terms

Rule indices:

  • logs-network_traffic.icmp-*

Severity: medium

Risk score: 47

Runs every: 5m

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

  • Domain: Network
  • Tactic: Command and Control
  • Use Case: Threat Detection
  • Use Case: Network Security Monitoring
  • Data Source: Network Traffic
  • Resources: Investigation Guide

Version: 1

Rule authors:

  • Elastic

Rule license: Elastic License v2

Investigation guide

edit

Triage and analysis

Disclaimer: This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

Investigating Potential ICMP Tunneling Activity to the Internet

ICMP tunneling encodes C2 or exfiltrated data inside echo request and reply payloads. This rule focuses on internal hosts sending unusually large echo transactions to external destinations, a pattern that differs from routine operating-system ping and most availability monitoring.

Possible investigation steps

  • Identify the source.ip host role. Servers and workstations that rarely initiate ICMP externally are higher concern.
  • Review the volume and cadence of echo traffic to the same destination.ip for beacon-like regularity.
  • Compare network.bytes across the conversation for asymmetric or variable payload sizes.
  • Correlate with endpoint process telemetry for non-standard ping utilities or custom clients if available.

False positive analysis

  • Some network path MTU discovery, diagnostic suites, or vendor appliances generate larger ICMP payloads. Validate and except known monitoring sources and destinations.
  • Cloud health checks occasionally use ICMP with non-default sizes; confirm against provider documentation before excepting.

Response and remediation

  • Block unauthorized outbound ICMP at the perimeter where policy permits, or restrict it to approved monitoring paths.
  • Isolate the source host if covert-channel tooling is confirmed.
  • Inspect the external destination against threat intelligence and block if malicious.

Setup

edit

Setup

This rule requires the Elastic network_traffic integration capturing ICMP transactions (network_traffic.icmp data stream). Flow-only telemetry without ICMP payload size is insufficient.

Rule query

edit
data_stream.dataset:network_traffic.icmp
  and (network_traffic.icmp.request.type:(8 or 128) or icmp.request.type:(8 or 128))
  and network.transport:(icmp or ipv6-icmp)
  and source.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16 or "FC00::/7")
  and network.bytes >= 256
  and not destination.ip:(
    10.0.0.0/8 or 100.64.0.0/10 or 127.0.0.0/8 or 169.254.0.0/16 or 172.16.0.0/12 or 192.168.0.0/16 or
    192.0.0.0/24 or 192.0.0.0/29 or 192.0.0.8/32 or 192.0.0.9/32 or 192.0.0.10/32 or 192.0.0.170/32 or
    192.0.0.171/32 or 192.0.2.0/24 or 192.175.48.0/24 or 192.31.196.0/24 or 192.52.193.0/24 or 192.88.99.0/24 or
    198.18.0.0/15 or 198.51.100.0/24 or 203.0.113.0/24 or 224.0.0.0/4 or 240.0.0.0/4 or "::1" or "FC00::/7" or
    "FE80::/10" or "FF00::/8"
  )

Framework: MITRE ATT&CKTM

« Potential Privilege Escalation via a Parent/Child Process Sequence ICMP Redirect Message from Internal Host »