mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Patrick Bareiss
49 lines
2.6 KiB
YAML
49 lines
2.6 KiB
YAML
name: Detect Large Outbound ICMP Packets
|
|
id: e9c102de-4d43-42a7-b1c8-8062ea297419
|
|
version: 2
|
|
date: '2018-06-01'
|
|
description: This search looks for outbound ICMP packets with a packet size larger
|
|
than 1,000 bytes. Various threat actors have been known to use ICMP as a command
|
|
and control channel for their attack infrastructure. Large ICMP packets from an
|
|
endpoint to a remote host may be indicative of this activity.
|
|
how_to_implement: 'In order to run this search effectively, we highly recommend that
|
|
you leverage the Assets and Identity framework. It is important that you have a
|
|
good understanding of how your network segments are designed and that you are able
|
|
to distinguish internal from external address space. Add a category named `internal`
|
|
to the CIDRs that host the company''s assets in the `assets_by_cidr.csv` lookup
|
|
file, which is located in `$SPLUNK_HOME/etc/apps/SA-IdentityManagement/lookups/`.
|
|
More information on updating this lookup can be found here: https://docs.splunk.com/Documentation/ES/5.0.0/Admin/Addassetandidentitydata.
|
|
This search also requires you to be ingesting your network traffic and populating
|
|
the Network_Traffic data model'
|
|
type: ESCU
|
|
references: []
|
|
author: Rico Valdez, Splunk
|
|
search: '| tstats `security_content_summariesonly` count earliest(_time) as firstTime
|
|
latest(_time) as lastTime values(All_Traffic.action) values(All_Traffic.bytes) from
|
|
datamodel=Network_Traffic where All_Traffic.action !=blocked All_Traffic.dest_category
|
|
!=internal (All_Traffic.protocol=icmp OR All_Traffic.transport=icmp) All_Traffic.bytes
|
|
> 1000 by All_Traffic.src_ip All_Traffic.dest_ip | `drop_dm_object_name("All_Traffic")`
|
|
| search ( dest_ip!=10.0.0.0/8 AND dest_ip!=172.16.0.0/12 AND dest_ip!=192.168.0.0/16)
|
|
| `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)` | `detect_large_outbound_icmp_packets_filter`'
|
|
known_false_positives: ICMP packets are used in a variety of ways to help troubleshoot
|
|
networking issues and ensure the proper flow of traffic. As such, it is possible
|
|
that a large ICMP packet could be perfectly legitimate. If large ICMP packets are
|
|
associated with command and control traffic, there will typically be a large number
|
|
of these packets observed over time. If the search is providing a large number of
|
|
false positives, you can modify the search to adjust the byte threshold or whitelist
|
|
specific IP addresses, as necessary.
|
|
tags:
|
|
analytics_story:
|
|
- Command and Control
|
|
mitre_attack_id:
|
|
- T1095
|
|
kill_chain_phases:
|
|
- Command and Control
|
|
cis20:
|
|
- CIS 9
|
|
- CIS 12
|
|
nist:
|
|
- DE.AE
|
|
security_domain: network
|
|
asset_type: Endpoint
|