PowerShell ICMP Exfiltration
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Detects Exfiltration Over Alternative Protocol - ICMP. Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel.
Severity
Trouble
Rule Requirement
Criteria
Action1: actionname = "PowerShell Script Block Logged" AND SCRIPTEXECUTED contains "New-Object" AND SCRIPTEXECUTED contains "System.Net.NetworkInformation.Ping" AND SCRIPTEXECUTED contains ".Send(" select Action1.HOSTNAME,Action1.MESSAGE,Action1.SCRIPTEXECUTED
Detection
Execution Mode
realtime
Log Sources
Windows
Author
Bartlomiej Czyz @bczyz1, oscd.community
