Data Exfiltration via ICMP Tunneling

// THREAT: ICMP Tunnel Exfiltration
// Signal 1: ping.exe invoked with oversized payload or high-repeat flags (host-level, EDR-visible)
let SuspiciousPing = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "ping.exe"
| extend PayloadSize = extract(@"-l\s+(\d+)", 1, ProcessCommandLine)
| extend RepeatFlag = ProcessCommandLine has_any ("-t", "-n 500", "-n 1000")
| where (isnotempty(PayloadSize) and toint(PayloadSize) > 1000) or RepeatFlag
| extend Signal = "OversizedOrContinuousPing"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
    InitiatingProcessFileName, Signal;
// Signal 2: known ICMP tunneling tool binaries dropped or executed
let KnownTools = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName has_any ("icmpsh", "ptunnel", "hans.exe", "hans", "pingtunnel", "icmptunnel")
| extend Signal = "KnownICMPTunnelTool"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
    InitiatingProcessFileName, Signal;
SuspiciousPing
| union KnownTools
| sort by Timestamp desc
// NOTE: DeviceNetworkEvents does NOT capture ICMP traffic in Microsoft Defender for Endpoint.
// Pair this query with the CommonSecurityLog / firewall-based hunting query below for
// network-layer confirmation of high-volume or high-frequency ICMP flows to public IPs.

index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
(
  (Image="*\\ping.exe" AND (CommandLine="*-l *" OR CommandLine="*-t*"))
  OR Image IN ("*\\icmpsh*", "*\\ptunnel*", "*\\hans.exe", "*\\pingtunnel*", "*\\icmptunnel*")
)
| rex field=CommandLine "-l\s+(?<PayloadSize>\d+)"
| eval Signal=case(
    match(Image, "(?i)icmpsh|ptunnel|hans|pingtunnel|icmptunnel"), "KnownICMPTunnelTool",
    isnotnull(PayloadSize) AND PayloadSize>1000, "OversizedPing",
    match(CommandLine, "(?i)-t"), "ContinuousPing",
    true(), "PingActivity"
  )
| table _time, host, User, Image, CommandLine, PayloadSize, Signal
| sort - _time

process where event.type == "start" and (
  (process.name : "ping.exe" and (process.args : "-l" or process.args : "-t")) or
  process.name : ("icmpsh*", "ptunnel*", "hans.exe", "pingtunnel*", "icmptunnel*")
)

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS EventTime,
  sourceip AS SourceIP,
  destinationip AS DestinationIP,
  username AS Username,
  "Process Name" AS ProcessName,
  "Command" AS CommandLine,
  CASE
    WHEN LOWER("Process Name") LIKE '%icmpsh%' OR LOWER("Process Name") LIKE '%ptunnel%'
      OR LOWER("Process Name") LIKE '%hans%' OR LOWER("Process Name") LIKE '%pingtunnel%' THEN 'KnownICMPTunnelTool'
    WHEN LOWER("Process Name") LIKE '%ping.exe%' AND LOWER("Command") LIKE '%-l%' THEN 'OversizedPing'
    WHEN LOWER("Process Name") LIKE '%ping.exe%' AND LOWER("Command") LIKE '%-t%' THEN 'ContinuousPing'
    ELSE 'Other'
  END AS Signal
FROM events
WHERE
  QIDNAME(qid) LIKE '%Process Create%'
  AND (
    LOWER("Process Name") LIKE '%ping.exe%'
    OR LOWER("Process Name") LIKE '%icmpsh%'
    OR LOWER("Process Name") LIKE '%ptunnel%'
    OR LOWER("Process Name") LIKE '%hans%'
    OR LOWER("Process Name") LIKE '%pingtunnel%'
  )
  AND starttime > NOW() - 86400000
UNION
SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS EventTime,
  sourceip AS SourceIP,
  destinationip AS DestinationIP,
  username AS Username,
  'N/A' AS ProcessName,
  'ICMP Flow' AS CommandLine,
  'HighVolumeICMPFlow' AS Signal
FROM flows
WHERE
  protocolid = 1
  AND NOT (destinationip LIKE '10.%' OR destinationip LIKE '192.168.%' OR destinationip LIKE '172.16.%')
  AND starttime > NOW() - 86400000
ORDER BY EventTime DESC

(_sourceCategory=*/Windows/Sysmon*) EventID=1
| parse field=_raw "Image: *\r" as Image nodrop
| parse field=_raw "CommandLine: *\r" as CommandLine nodrop
| where Image matches "*ping.exe" or Image matches "*icmpsh*" or Image matches "*ptunnel*"
    or Image matches "*hans*" or Image matches "*pingtunnel*"
| eval Signal = if(Image matches "*icmpsh*" or Image matches "*ptunnel*" or Image matches "*hans*" or Image matches "*pingtunnel*",
    "KnownICMPTunnelTool",
    if(CommandLine matches "*-l*", "OversizedPing",
    if(CommandLine matches "*-t*", "ContinuousPing", "Other")))
| where Signal != "Other"
| stats count as EventCount, values(CommandLine) as Commands by Computer, User, Image, Signal
| sort by EventCount desc

rule icmp_tunnel_exfiltration {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects host-level indicators of ICMP tunnel exfiltration: oversized/continuous ping usage or named ICMP tunneling tool execution"
    severity = "HIGH"
    mitre_attack_tactic = "Exfiltration"
    mitre_attack_technique = "T1048.003"
    created = "2026-07-14"

  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    (
      (
        re.regex($e.target.process.file.full_path, `(?i)ping\.exe$`) and
        re.regex($e.target.process.command_line, `(?i)(-l\s+\d{4,}|-t\b)`)
      )
      or
      re.regex($e.target.process.file.full_path, `(?i)(icmpsh|ptunnel|hans|pingtunnel|icmptunnel)`)
    )

  condition:
    $e
}

#event_simpleName=ProcessRollup2
| FileName=/(?i)ping\.exe$/
| CommandLine=/(?i)(-l\s+\d{4,}|-t\b)/
| Signal := "OversizedOrContinuousPing"
| groupBy([ComputerName, UserName, CommandLine], function=[count(as=EventCount)])
| sort(EventCount, order=desc)

// Companion search for named ICMP tunneling tools:
// #event_simpleName=ProcessRollup2
// | FileName=/(?i)(icmpsh|ptunnel|hans|pingtunnel|icmptunnel)/
// | Signal := "KnownICMPTunnelTool"
// | table([ComputerName, UserName, FileName, CommandLine, Signal])