Sample rules
Detect Large Outbound ICMP Packets
- source: splunk
- technicques:
- T1095
Description
This analytic has been deprecated in favour of a better named detection - Detect Large ICMP Traffic. The following analytic identifies outbound ICMP packets with a size larger than 1,000 bytes. It leverages the Network_Traffic data model to detect unusually large ICMP packets that are not blocked and are destined for external IP addresses. This activity is significant because threat actors often use ICMP for command and control communication, and large ICMP packets can indicate data exfiltration or other malicious activities. If confirmed malicious, this could allow attackers to maintain covert communication channels, exfiltrate sensitive data, or further compromise the network.
Detection logic
| tstats `security_content_summariesonly` count earliest(_time) as firstTime
latest(_time) as lastTime values(All_Traffic.action) as action values(All_Traffic.bytes)
as bytes from
datamodel=Network_Traffic where All_Traffic.action !=blocked (All_Traffic.protocol=icmp
OR All_Traffic.transport=icmp) All_Traffic.bytes
> 1000 AND NOT All_Traffic.dest_ip IN ("10.0.0.0/8","172.16.0.0/12","192.168.0.0/16")
by All_Traffic.src_ip All_Traffic.dest_ip All_Traffic.protocol
| `drop_dm_object_name("All_Traffic")`
| iplocation dest_ip
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `detect_large_outbound_icmp_packets_filter`
Detect Large ICMP Traffic
- source: splunk
- technicques:
- T1095
Description
The following analytic identifies ICMP traffic to external IP addresses with total bytes (sum of bytes in and bytes out) greater than 1,000 bytes. It leverages the Network_Traffic data model to detect large ICMP packet that aren’t blocked and are directed toward external networks. We use All_Traffic.bytes in the detection to capture variations in inbound versus outbound traffic sizes, as significant discrepancies or unusually large ICMP exchanges can indicate information smuggling, covert communication, or command-and-control (C2) activities. If validated as malicious, this could signal ICMP tunneling, unauthorized data transfer, or compromised endpoints requiring immediate investigation.
Detection logic
| tstats `security_content_summariesonly` count earliest(_time) as firstTime latest(_time) as lastTime values(All_Traffic.action) as action
from datamodel=Network_Traffic where All_Traffic.bytes > 1000 AND All_Traffic.action != blocked AND (All_Traffic.protocol=icmp OR All_Traffic.transport=icmp) AND NOT All_Traffic.dest_ip IN ("10.0.0.0/8","172.16.0.0/12","192.168.0.0/16")
by All_Traffic.src_ip, All_Traffic.dest_ip, All_Traffic.protocol All_Traffic.bytes
| `drop_dm_object_name("All_Traffic")`
| iplocation dest_ip
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `detect_large_icmp_traffic_filter`