ICMP Redirect Message from Internal Host

 1[metadata]
 2creation_date = "2026/06/25"
 3integration = ["network_traffic"]
 4maturity = "production"
 5updated_date = "2026/06/25"
 6
 7[rule]
 8author = ["Elastic"]
 9description = """
10Identifies ICMP Redirect messages (type 5 for IPv4, type 137 for IPv6) sourced from an internal IPv4 or IPv6 address.
11Legitimate redirects are normally sent only by on-path routers. A workstation or server emitting redirects can indicate
12route manipulation for adversary-in-the-middle activity.
13"""
14from = "now-9m"
15index = ["logs-network_traffic.icmp-*"]
16language = "kuery"
17license = "Elastic License v2"
18name = "ICMP Redirect Message from Internal Host"
19note = """## Triage and analysis
20
21> **Disclaimer**:
22> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
23
24### Investigating ICMP Redirect Message from Internal Host
25
26ICMP Redirect instructs a host to send traffic for a destination through a different next hop. On most enterprise
27segments, only infrastructure routers should emit redirects; a user workstation or server doing so is a strong
28adversary-in-the-middle indicator.
29
30### Possible investigation steps
31
32- Identify the redirect source in `source.ip` and locate the asset on the VLAN. Confirm whether it is an authorized
33  router or gateway.
34- Review the redirect target and affected destination in ICMP fields and adjacent flow records to see which routes or
35  resolvers were being manipulated.
36- Check whether affected clients show DNS, gateway, or VPN routing changes around the alert time.
37- Correlate with DHCP, ARP, or LLMNR/NBT-NS alerts on the same segment for combined MITM activity.
38
39### False positive analysis
40
41- Some legacy network appliances, hypervisor gateways, or misconfigured Linux hosts with IP forwarding enabled may
42  emit redirects. Maintain exceptions for known router and gateway IPs after validation.
43- Lab networks that intentionally test route injection should be scoped out by source subnet.
44
45### Response and remediation
46
47- Isolate the emitting host if it is not an authorized router.
48- Disable ICMP redirect acceptance on affected clients where policy allows, and block redirect-generating hosts at the
49  access layer.
50- Review segment routing, default gateways, and DHCP options for unauthorized changes."""
51references = [
52    "https://www.rfc-editor.org/rfc/rfc792",
53    "https://www.rfc-editor.org/rfc/rfc4443",
54    "https://zimperium.com/blog/doubledirect-zimperium-discovers-full-duplex-icmp-redirect-attacks-in-the-wild",
55]
56risk_score = 73
57rule_id = "2014ebd8-b847-4cc0-a827-d0d61ec88680"
58setup = """## Setup
59
60This rule requires ICMP transaction telemetry from the Elastic network_traffic integration (`network_traffic.icmp`
61data stream). Flow-only exporters that do not record ICMP type/code will not satisfy this rule.
62"""
63severity = "high"
64tags = [
65    "Domain: Network",
66    "Tactic: Credential Access",
67    "Use Case: Threat Detection",
68    "Use Case: Network Security Monitoring",
69    "Data Source: Network Traffic",
70    "Resources: Investigation Guide",
71]
72timestamp_override = "event.ingested"
73type = "query"
74
75query = '''
76data_stream.dataset:network_traffic.icmp
77  and (network_traffic.icmp.request.type:(5 or 137) or icmp.request.type:(5 or 137))
78  and source.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16 or "FC00::/7" or "FE80::/10")
79'''
80
81
82[[rule.threat]]
83framework = "MITRE ATT&CK"
84[[rule.threat.technique]]
85id = "T1557"
86name = "Adversary-in-the-Middle"
87reference = "https://attack.mitre.org/techniques/T1557/"
88
89
90[rule.threat.tactic]
91id = "TA0006"
92name = "Credential Access"
93reference = "https://attack.mitre.org/tactics/TA0006/"