Exfiltration Over C2 Channel — Data Exfiltration via ICMP Covert Channel

let LookbackWindow = 24h;
let MinSessionCount = 200; // sustained tunneling logs far more permitted ICMP sessions than occasional diagnostic pings
let MinAvgBytesPerSession = 100; // default OS ping payload is 32-64 bytes; tunneling tools pad payload well beyond that to carry data
let MinDurationMinutes = 10; // tunnels run continuously rather than as a one-off burst
CommonSecurityLog
| where TimeGenerated > ago(LookbackWindow)
| where Protocol =~ "ICMP"
| where DeviceAction in~ ("allow", "permit", "accept")
| where ipv4_is_private(DestinationIP) == false
| summarize
    SessionCount = count(),
    TotalBytes = sum(SentBytes + ReceivedBytes),
    FirstSeen = min(TimeGenerated),
    LastSeen = max(TimeGenerated)
    by SourceIP, DestinationIP, DeviceVendor, DeviceProduct
| extend AvgBytesPerSession = TotalBytes / SessionCount
| extend DurationMinutes = datetime_diff('minute', LastSeen, FirstSeen)
| extend IsHighVolume = SessionCount >= MinSessionCount
| extend IsOversizedPayload = AvgBytesPerSession >= MinAvgBytesPerSession
| extend IsSustained = DurationMinutes >= MinDurationMinutes
| extend IcmpScore = tolong(IsHighVolume) + tolong(IsOversizedPayload) + tolong(IsSustained)
| where IcmpScore >= 2
| project FirstSeen, LastSeen, SourceIP, DestinationIP, DeviceVendor, DeviceProduct,
    SessionCount, TotalBytes, AvgBytesPerSession, DurationMinutes, IcmpScore
| sort by IcmpScore desc, SessionCount desc

index=zeek sourcetype="bro:conn:json" proto="icmp"
| where NOT (cidrmatch("10.0.0.0/8", 'id.resp_h') OR cidrmatch("172.16.0.0/12", 'id.resp_h') OR cidrmatch("192.168.0.0/16", 'id.resp_h') OR cidrmatch("127.0.0.0/8", 'id.resp_h'))
| stats
    count as SessionCount,
    sum(orig_pkts) as TotalPackets,
    sum(orig_ip_bytes + resp_ip_bytes) as TotalBytes,
    earliest(ts) as FirstSeen,
    latest(ts) as LastSeen
    by 'id.orig_h', 'id.resp_h'
| eval AvgBytesPerPacket=round(TotalBytes/TotalPackets, 1)
| eval DurationMinutes=round((LastSeen-FirstSeen)/60, 1)
| eval IsHighVolume=if(TotalPackets>=500, 1, 0)
| eval IsOversizedPayload=if(AvgBytesPerPacket>=100, 1, 0)
| eval IsSustained=if(DurationMinutes>=10, 1, 0)
| eval IcmpScore=IsHighVolume+IsOversizedPayload+IsSustained
| where IcmpScore>=2
| eval FirstSeen=strftime(FirstSeen, "%Y-%m-%d %H:%M:%S")
| eval LastSeen=strftime(LastSeen, "%Y-%m-%d %H:%M:%S")
| table FirstSeen, LastSeen, 'id.orig_h', 'id.resp_h', SessionCount, TotalPackets, TotalBytes, AvgBytesPerPacket, DurationMinutes, IcmpScore
| sort - IcmpScore, - TotalPackets

network where event.category == "network" and network.transport == "icmp" and destination.bytes >= 100

SELECT
    sourceip AS SourceIP,
    destinationip AS DestinationIP,
    COUNT(*) AS SessionCount,
    SUM(sourcepackets + destinationpackets) AS TotalPackets,
    SUM(sourcebytes + destinationbytes) AS TotalBytes,
    MIN(firstpackettime) AS FirstSeen,
    MAX(lastpackettime) AS LastSeen
FROM flows
WHERE
    protocolid = 1 -- ICMP
    AND firstpackettime > (NOW() - 86400000)
GROUP BY sourceip, destinationip
HAVING
    SUM(sourcepackets + destinationpackets) >= 500
    AND (SUM(sourcebytes + destinationbytes) / SUM(sourcepackets + destinationpackets)) >= 100
ORDER BY TotalPackets DESC

_sourceCategory=network/paloalto (proto=icmp OR proto=1)
| parse "src=*," as src_ip nodrop
| parse "dst=*," as dst_ip nodrop
| parse "bytes_sent=*," as bytes_sent nodrop
| parse "bytes_received=*," as bytes_received nodrop
| parse "elapsed=*," as elapsed_sec nodrop
| parse "action=*," as fw_action nodrop
| where fw_action = "allow"
| eval total_bytes = toLong(bytes_sent) + toLong(bytes_received)
| count as SessionCount, sum(total_bytes) as TotalBytes, sum(toLong(elapsed_sec)) as TotalDurationSec by src_ip, dst_ip
| eval AvgBytesPerSession = TotalBytes / SessionCount
| where SessionCount >= 200 and AvgBytesPerSession >= 100
| sort by SessionCount desc

rule icmp_c2_exfiltration_covert_channel {
  meta:
    author = "Detection Engineering"
    description = "Detects ICMP covert-channel exfiltration via sustained session volume and oversized payload size, sourced from firewall/network telemetry rather than endpoint EDR (which does not capture ICMP)."
    mitre_attack_tactic = "Exfiltration"
    mitre_attack_technique = "T1041"
    severity = "HIGH"
    priority = "HIGH"

  events:
    $e.metadata.event_type = "NETWORK_CONNECTION"
    $e.network.ip_protocol = "ICMP"
    $e.security_result.action = "ALLOW"
    $src = $e.principal.ip
    $dst = $e.target.ip
    $bytes = $e.network.sent_bytes + $e.network.received_bytes

  match:
    $src, $dst over 1h

  outcome:
    $session_count = count($e.metadata.id)
    $total_bytes = sum($bytes)
    $avg_bytes_per_session = $total_bytes / $session_count

  condition:
    $e and $session_count >= 200 and $avg_bytes_per_session >= 100
}

#repo = firewall_logs
| proto = "icmp" OR proto = "1"
| action = "allow"
| bytes_sent := parseFloat(bytes_sent)
| bytes_received := parseFloat(bytes_received)
| total_bytes := bytes_sent + bytes_received
| groupBy(
    [src_ip, dst_ip],
    function=[
      count(as=SessionCount),
      sum(field=total_bytes, as=TotalBytes)
    ]
  )
| AvgBytesPerSession := TotalBytes / SessionCount
| test(SessionCount >= 200 && AvgBytesPerSession >= 100)
| sort(field=SessionCount, order=desc)