ICMP Timestamp or Information Request from the Internet

  1[metadata]
  2creation_date = "2026/06/25"
  3integration = ["network_traffic"]
  4maturity = "production"
  5updated_date = "2026/06/25"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identifies inbound ICMP Timestamp (type 13) or Information (type 15) requests from external addresses to internal
 11RFC1918 destinations. These message types are rarely used in modern networks and are commonly associated with host and
 12path fingerprinting during reconnaissance.
 13"""
 14from = "now-9m"
 15index = ["logs-network_traffic.icmp-*"]
 16language = "kuery"
 17license = "Elastic License v2"
 18name = "ICMP Timestamp or Information Request from the Internet"
 19note = """## Triage and analysis
 20
 21> **Disclaimer**:
 22> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
 23
 24### Investigating ICMP Timestamp or Information Request from the Internet
 25
 26ICMP Timestamp and Information requests are legacy diagnostic messages. Inbound use from the Internet toward internal
 27hosts is uncommon in production networks and often indicates active scanning or OS fingerprinting.
 28
 29### Possible investigation steps
 30
 31- Review `source.ip` against threat intelligence and prior scan activity on the environment.
 32- Determine whether the targeted `destination.ip` is an exposed host, VPN concentrator, or mis-NATed internal asset.
 33- Look for adjacent port scans, SYN sweeps, or exploit attempts from the same source around the alert window.
 34- Check whether the destination host replied and whether follow-on connections were attempted.
 35
 36### False positive analysis
 37
 38- Some legacy network monitoring or SLA probes may still use ICMP Timestamp requests. Maintain exceptions for known
 39  monitoring source ranges after validation.
 40- Shared hosting or multi-tenant environments with overlapping address space may require destination-specific tuning.
 41
 42### Response and remediation
 43
 44- Block or rate-limit the external source at the perimeter if activity is unauthorized.
 45- Verify that the targeted internal host is not unintentionally exposed to the Internet.
 46- Increase monitoring on targeted assets for follow-on exploitation attempts."""
 47references = [
 48    "https://www.rfc-editor.org/rfc/rfc792",
 49    "https://nmap.org/book/host-discovery-techniques.html",
 50    "https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml",
 51]
 52risk_score = 21
 53rule_id = "81139742-4d3a-49f3-a6dd-e0fb9834f959"
 54setup = """## Setup
 55
 56This rule requires ICMP transaction telemetry from the Elastic network_traffic integration (`network_traffic.icmp`
 57data stream).
 58"""
 59severity = "low"
 60tags = [
 61    "Domain: Network",
 62    "Tactic: Discovery",
 63    "Tactic: Reconnaissance",
 64    "Use Case: Network Security Monitoring",
 65    "Use Case: Threat Detection",
 66    "Data Source: Network Traffic",
 67    "Resources: Investigation Guide",
 68]
 69timestamp_override = "event.ingested"
 70type = "query"
 71
 72query = '''
 73data_stream.dataset:network_traffic.icmp
 74  and (network_traffic.icmp.request.type:(13 or 15) or icmp.request.type:(13 or 15))
 75  and destination.ip:(
 76    10.0.0.0/8 or
 77    172.16.0.0/12 or
 78    192.168.0.0/16
 79  )
 80  and not source.ip:(
 81    10.0.0.0/8 or
 82    100.64.0.0/10 or
 83    127.0.0.0/8 or
 84    169.254.0.0/16 or
 85    172.16.0.0/12 or
 86    192.168.0.0/16 or
 87    192.0.0.0/24 or
 88    192.0.0.0/29 or
 89    192.0.0.8/32 or
 90    192.0.0.9/32 or
 91    192.0.0.10/32 or
 92    192.0.0.170/32 or
 93    192.0.0.171/32 or
 94    192.0.2.0/24 or
 95    192.175.48.0/24 or
 96    192.31.196.0/24 or
 97    192.52.193.0/24 or
 98    192.88.99.0/24 or
 99    198.18.0.0/15 or
100    198.51.100.0/24 or
101    203.0.113.0/24 or
102    224.0.0.0/4 or
103    240.0.0.0/4 or
104    "::1" or
105    "FE80::/10" or
106    "FF00::/8"
107  )
108'''
109
110
111[[rule.threat]]
112framework = "MITRE ATT&CK"
113[[rule.threat.technique]]
114id = "T1018"
115name = "Remote System Discovery"
116reference = "https://attack.mitre.org/techniques/T1018/"
117
118
119[rule.threat.tactic]
120id = "TA0007"
121name = "Discovery"
122reference = "https://attack.mitre.org/tactics/TA0007/"
123[[rule.threat]]
124framework = "MITRE ATT&CK"
125[[rule.threat.technique]]
126id = "T1595"
127name = "Active Scanning"
128reference = "https://attack.mitre.org/techniques/T1595/"
129[[rule.threat.technique.subtechnique]]
130id = "T1595.001"
131name = "Scanning IP Blocks"
132reference = "https://attack.mitre.org/techniques/T1595/001/"
133
134
135
136[rule.threat.tactic]
137id = "TA0043"
138name = "Reconnaissance"
139reference = "https://attack.mitre.org/tactics/TA0043/"