Threat Hunting Exercise: Analyzing Firewall ICMP Tunnel Data Exfiltration Dataset
This hunt uses a simulated perimeter firewall dataset (firewall_icmp_tunnel_2022-08-25T170000.json) capturing T1048.003: Exfiltration Over Alternative Protocol (ICMP Tunneling), where an attacker encodes stolen data within ICMP echo request/reply payloads to exfiltrate it past firewalls that permit outbound ping but do not deeply inspect its contents.
Step 1: Hypothesis Formation
Hypothesis: A host generates a sustained, high-volume stream of ICMP echo requests to a single external IP, with payload sizes and/or entropy far exceeding the default ICMP echo payload (typically 32-64 bytes of a fixed pattern), indicating the ICMP payload is carrying encoded data rather than serving a diagnostic ping purpose. Indicators:
- ICMP echo request payload size consistently near the path MTU (e.g., 1400+ bytes) rather than the OS-default small fixed payload.
- High Shannon entropy in the ICMP payload bytes, inconsistent with the repeating pattern (
abcdefgh...) used by standard ping implementations. - Sustained volume/duration (hundreds to thousands of packets over minutes to hours) far exceeding any legitimate connectivity-testing use case.
- The destination IP has no legitimate business relationship and is not a monitoring/uptime service.
Null Hypothesis: A legitimate network monitoring tool (e.g., an MTU-discovery or link-quality test) is sending large ICMP packets as part of routine diagnostics. Invalidate by confirming the tool/process and destination against approved network-operations tooling and IPs.
Rationale: Because most perimeter firewalls default to allowing outbound ICMP for basic connectivity troubleshooting, and rarely inspect payload content, ICMP tunneling is a durable low-and-slow exfiltration channel; this hunt validates payload-size and entropy-based ICMP inspection as a control independent of standard ICMP allow/deny policy.
Step 2: Data Sources and Scope
- Sources: Perimeter firewall logs with payload metadata (size, and where available, deep-packet-inspection entropy scoring); NetFlow records for ICMP traffic; endpoint process telemetry for the generating process.
- Scope: ~2022-08-25T17:00:00-18:30:00 UTC; Host: WKS-FIN-062 (10.300.5.27); Destination: 91.219.237.99 (no known business relationship).
- SIEM Queries (Splunk/ELK):
index=firewall protocol=ICMP type=8 | stats avg(payload_size) as avg_size, count as pkt_count by src_ip, dest_ip, bucket(_time,10m) | where avg_size>1000- Entropy flag (where DPI metadata available):
index=firewall protocol=ICMP payload_entropy>7.0 - Duration/volume:
index=firewall protocol=ICMP src_ip="10.300.5.27" | stats count by dest_ip | where count>500
Step 3: Key Findings
Parsed events (5 shown) confirm WKS-FIN-062 sent over 4,200 oversized, high-entropy ICMP echo requests to a single external IP over 90 minutes, consistent with a covert exfiltration tunnel.
| Timestamp (UTC) | Host | Event | Detail | IOC/Why Suspicious? |
|---|---|---|---|---|
| 2022-08-25 17:00:03 | WKS-FIN-062 | Firewall (allow, ICMP type 8) | Payload size 1,400 bytes to 91.219.237.99 | Payload-Size IOC: default Windows/Linux ping payloads are 32-56 bytes; 1,400 bytes is consistent with data-carrying tunneling tools (e.g., icmpsh, ptunnel). |
| 2022-08-25 17:00:03 - 18:29:50 | WKS-FIN-062 | Firewall (aggregate) | 4,214 ICMP echo requests to the same destination, average payload 1,380 bytes, Shannon entropy 7.6 | Volume + Entropy IOC: sustained high-volume, high-entropy payloads over 90 minutes - inconsistent with any legitimate diagnostic ping burst, and the entropy rules out a fixed diagnostic byte pattern. |
| 2022-08-25 17:15:22 | WKS-FIN-062 | (EDR process check) | Unsigned binary netdiag.exe (in reality an icmpsh-family tool) actively generating raw ICMP sockets | Tooling IOC: raw-socket ICMP generation from a non-network-utility binary confirms deliberate tunnel client activity. |
| - | - | (destination check) | 91.219.237.99: no reverse DNS, no reputation history, hosting provider flagged in threat-intel as previously associated with C2 infrastructure | Corroborates the destination as attacker-controlled infrastructure, not a legitimate monitoring endpoint. |
| - | WKS-FIN-062 | (file access correlation) | EDR shows the same process reading files from a mapped finance share (\\FS01\Finance$) in the minutes preceding each ICMP burst | Exfil-Source IOC: file reads from a sensitive share immediately correlate with the ICMP transmission bursts, indicating the tunneled data originates from that share. |
Validation:
- Timeline: sustained 90-minute high-volume, high-entropy ICMP stream to a single reputation-flagged IP, correlated with file reads from a sensitive finance share - matches the known behavioral profile of ICMP-tunnel exfiltration tooling.
- False Positives: no network-operations ticket or approved monitoring tool accounts for this traffic; the generating binary is unsigned and uses raw sockets atypical of legitimate diagnostic utilities.
- Correlation: payload size/entropy, tool identification, destination reputation, and correlated sensitive-file access together confirm active data exfiltration over an ICMP tunnel.
Step 4: Recommendations & Next Steps
- Immediate Response: Isolate WKS-FIN-062 immediately; block 91.219.237.99 at the perimeter; identify the full scope of data accessed from the finance share during the exfiltration window; preserve the endpoint for forensic analysis of the tunneling tool and any staged data.
- Detection: Sigma-style rule:
title: ICMP Tunnel - Oversized High-Entropy Echo Requests→selection: protocol=ICMP AND type=8 AND avg_payload_size>500 AND payload_entropy>6.5 AND packet_count_per_dest_10m>100. - Pro Tip: Where full ICMP payload inspection isn't feasible, alert on ICMP payload-size deviation from the OS-default fixed pattern alone - legitimate ping traffic is overwhelmingly small and low-entropy, so this single, low-effort metric catches the majority of ICMP tunneling tools without requiring full DPI investment.
Hypothesis confirmed - an attacker used an ICMP tunneling tool to exfiltrate data read from a sensitive finance share, sending over 4,200 oversized, high-entropy ICMP packets to an external C2-associated IP over 90 minutes!