| ID | Technique | Tactic |
|---|---|---|
| T1095 | Non-Application Layer Protocol | Command and Control |
Detection: Detect Large Outbound ICMP Packets
REMOVED DETECTION
This detection has been removed from the Splunk Threat Research content library and is no longer maintained or supported.
Reason: Detection has been replaced by a new detection with a more specific name
Removed in version: 5.6.0
Replacement: Detect Large ICMP Traffic
If you have any questions or concerns, please reach out to us at research@splunk.com.
Description
This analytic has been deprecated in favour of a better named detection - Detect Large ICMP Traffic. The following analytic identifies outbound ICMP packets with a size larger than 1,000 bytes. It leverages the Network_Traffic data model to detect unusually large ICMP packets that are not blocked and are destined for external IP addresses. This activity is significant because threat actors often use ICMP for command and control communication, and large ICMP packets can indicate data exfiltration or other malicious activities. If confirmed malicious, this could allow attackers to maintain covert communication channels, exfiltrate sensitive data, or further compromise the network.
Search
1
2| tstats `security_content_summariesonly` count earliest(_time) as firstTime latest(_time) as lastTime values(All_Traffic.action) as action values(All_Traffic.bytes) as bytes from datamodel=Network_Traffic where All_Traffic.action !=blocked (All_Traffic.protocol=icmp OR All_Traffic.transport=icmp) All_Traffic.bytes > 1000 AND NOT All_Traffic.dest_ip IN ("10.0.0.0/8","172.16.0.0/12","192.168.0.0/16") by All_Traffic.action All_Traffic.app All_Traffic.bytes All_Traffic.bytes_in All_Traffic.bytes_out All_Traffic.dest All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.dvc All_Traffic.protocol All_Traffic.protocol_version All_Traffic.src All_Traffic.src_ip All_Traffic.src_port All_Traffic.transport All_Traffic.user All_Traffic.vendor_product
3| `drop_dm_object_name("All_Traffic")`
4| `security_content_ctime(firstTime)`
5| `security_content_ctime(lastTime)`
6| iplocation dest_ip
7| `detect_large_outbound_icmp_packets_filter`
Data Source
| Name | Platform | Sourcetype | Source |
|---|---|---|---|
| Palo Alto Network Traffic |  Network |
'pan:traffic' |
'not_applicable' |
Macros Used
| Name | Value |
|---|---|
| security_content_summariesonly | summariesonly=summariesonly_config allow_old_summaries=oldsummaries_config fillnull_value=fillnull_config`` |
| detect_large_outbound_icmp_packets_filter | `` |
detect_large_outbound_icmp_packets_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Annotations
MITRE ATT&CK
Kill Chain Phases
NIST
CIS
Threat Actors
Default Configuration
This detection is configured by default in Splunk Enterprise Security to run with the following settings:
| Setting | Value |
|---|---|
| Disabled | true |
| Cron Schedule | N/A |
| Earliest Time | N/A |
| Latest Time | N/A |
| Schedule Window | N/A |
| Creates Finding (Notable) | No |
| Creates Intermediate Finding (Risk Event) | No |
TTP detections generate a Finding (Notable) and may generate Intermediate Findings (Risk Events) for associated entities.
Implementation
In order to run this search effectively, we highly recommend that you leverage the Assets and Identity framework. It is important that you have a good understanding of how your network segments are designed and that you are able to distinguish internal from external address space. Add a category named internal to the CIDRs that host the company's assets in the assets_by_cidr.csv lookup file, which is located in $SPLUNK_HOME/etc/apps/SA-IdentityManagement/lookups/. More information on updating this lookup can be found here: https://docs.splunk.com/Documentation/ES/5.0.0/Admin/Addassetandidentitydata. This search also requires you to be ingesting your network traffic and populating the Network_Traffic data model
Known False Positives
ICMP packets are used in a variety of ways to help troubleshoot networking issues and ensure the proper flow of traffic. As such, it is possible that a large ICMP packet could be perfectly legitimate. If large ICMP packets are associated with Command And Control traffic, there will typically be a large number of these packets observed over time. If the search is providing a large number of false positives, you can modify the macro detect_large_outbound_icmp_packets_filter to adjust the byte threshold or add specific IP addresses to an allow list.
Associated Analytic Story
Detection Testing
| Test Type | Status | Dataset | Source | Sourcetype |
|---|---|---|---|---|
| Validation | Not Applicable | N/A | N/A | N/A |
| Unit | Not Applicable | N/A | N/A |
N/A |
| Integration | Not Applicable | N/A | N/A |
N/A |
Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI.
Alternatively you can replay a dataset into a Splunk Attack Range
Source: GitHub |
Version: 12