Potential ICMP Tunneling Activity to the Internet

  1[metadata]
  2creation_date = "2026/06/25"
  3integration = ["network_traffic"]
  4maturity = "production"
  5updated_date = "2026/06/25"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identifies ICMP Echo traffic from an internal host to an external destination with a larger-than-typical transaction
 11size. Covert channels and ICMP tunneling tools embed data in echo payloads that exceed normal OS ping behavior, which is
 12usually limited to small fixed-size packets.
 13"""
 14from = "now-9m"
 15index = ["logs-network_traffic.icmp-*"]
 16language = "kuery"
 17license = "Elastic License v2"
 18name = "Potential ICMP Tunneling Activity to the Internet"
 19note = """## Triage and analysis
 20
 21> **Disclaimer**:
 22> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
 23
 24### Investigating Potential ICMP Tunneling Activity to the Internet
 25
 26ICMP tunneling encodes C2 or exfiltrated data inside echo request and reply payloads. This rule focuses on internal
 27hosts sending unusually large echo transactions to external destinations, a pattern that differs from routine
 28operating-system ping and most availability monitoring.
 29
 30### Possible investigation steps
 31
 32- Identify the `source.ip` host role. Servers and workstations that rarely initiate ICMP externally are higher concern.
 33- Review the volume and cadence of echo traffic to the same `destination.ip` for beacon-like regularity.
 34- Compare `network.bytes` across the conversation for asymmetric or variable payload sizes.
 35- Correlate with endpoint process telemetry for non-standard ping utilities or custom clients if available.
 36
 37### False positive analysis
 38
 39- Some network path MTU discovery, diagnostic suites, or vendor appliances generate larger ICMP payloads. Validate and
 40  except known monitoring sources and destinations.
 41- Cloud health checks occasionally use ICMP with non-default sizes; confirm against provider documentation before
 42  excepting.
 43
 44### Response and remediation
 45
 46- Block unauthorized outbound ICMP at the perimeter where policy permits, or restrict it to approved monitoring paths.
 47- Isolate the source host if covert-channel tooling is confirmed.
 48- Inspect the external destination against threat intelligence and block if malicious."""
 49references = [
 50    "https://attack.mitre.org/techniques/T1572/",
 51    "https://www.rfc-editor.org/rfc/rfc792",
 52    "https://www.levelblue.com/blogs/spiderlabs-blog/backdoor-at-the-end-of-the-icmp-tunnel",
 53]
 54risk_score = 47
 55rule_id = "96dd08d8-8f3d-4f55-ada8-7dc1e05dbd47"
 56setup = """## Setup
 57
 58This rule requires the Elastic network_traffic integration capturing ICMP transactions (`network_traffic.icmp` data
 59stream). Flow-only telemetry without ICMP payload size is insufficient.
 60"""
 61severity = "medium"
 62tags = [
 63    "Domain: Network",
 64    "Tactic: Command and Control",
 65    "Use Case: Threat Detection",
 66    "Use Case: Network Security Monitoring",
 67    "Data Source: Network Traffic",
 68    "Resources: Investigation Guide",
 69]
 70timestamp_override = "event.ingested"
 71type = "new_terms"
 72
 73query = '''
 74data_stream.dataset:network_traffic.icmp
 75  and (network_traffic.icmp.request.type:(8 or 128) or icmp.request.type:(8 or 128))
 76  and network.transport:(icmp or ipv6-icmp)
 77  and source.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16 or "FC00::/7")
 78  and network.bytes >= 256
 79  and not destination.ip:(
 80    10.0.0.0/8 or 100.64.0.0/10 or 127.0.0.0/8 or 169.254.0.0/16 or 172.16.0.0/12 or 192.168.0.0/16 or
 81    192.0.0.0/24 or 192.0.0.0/29 or 192.0.0.8/32 or 192.0.0.9/32 or 192.0.0.10/32 or 192.0.0.170/32 or
 82    192.0.0.171/32 or 192.0.2.0/24 or 192.175.48.0/24 or 192.31.196.0/24 or 192.52.193.0/24 or 192.88.99.0/24 or
 83    198.18.0.0/15 or 198.51.100.0/24 or 203.0.113.0/24 or 224.0.0.0/4 or 240.0.0.0/4 or "::1" or "FC00::/7" or
 84    "FE80::/10" or "FF00::/8"
 85  )
 86'''
 87
 88
 89[[rule.threat]]
 90framework = "MITRE ATT&CK"
 91[[rule.threat.technique]]
 92id = "T1095"
 93name = "Non-Application Layer Protocol"
 94reference = "https://attack.mitre.org/techniques/T1095/"
 95
 96[[rule.threat.technique]]
 97id = "T1572"
 98name = "Protocol Tunneling"
 99reference = "https://attack.mitre.org/techniques/T1572/"
100
101
102[rule.threat.tactic]
103id = "TA0011"
104name = "Command and Control"
105reference = "https://attack.mitre.org/tactics/TA0011/"
106
107[rule.new_terms]
108field = "new_terms_fields"
109value = ["source.ip", "destination.ip"]
110[[rule.new_terms.history_window_start]]
111field = "history_window_start"
112value = "now-7d"