PowerShell ICMP Exfiltration via Ping .Send

Alerts on PowerShell that instantiates System.Net.NetworkInformation.Ping and calls .Send, consistent with ICMP-based exfiltration.

FreeUnreviewedSigmamediumv1

powershell-icmp-exfiltration-via-ping-send-4c4af3cd

title: PowerShell ICMP Exfiltration via Ping .Send
id: 56b77a90-eb44-4834-a531-5194ffe74573
status: test
description: This rule flags PowerShell script content that creates a .NET NetworkInformation Ping object and calls its Send method. It is intended to catch attempts to move data over ICMP as an alternate exfiltration channel, using PowerShell to generate and transmit payloads through Ping-related networking APIs. Detection relies on Script Block Logging telemetry that records the PowerShell script block text for the presence of the specified PowerShell/.NET constructs.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1048.003/T1048.003.md#atomic-test-2---exfiltration-over-alternative-protocol---icmp
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_icmp_exfiltration.yml
author: Bartlomiej Czyz @bczyz1, oscd.community, Huntrule Team
date: 2020-10-10
modified: 2022-12-25
tags:
  - attack.exfiltration
  - attack.t1048.003
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|contains|all:
      - New-Object
      - System.Net.NetworkInformation.Ping
      - .Send(
  condition: selection
falsepositives:
  - Legitimate usage of System.Net.NetworkInformation.Ping class
level: medium
license: DRL-1.1
related:
  - id: 4c4af3cd-2115-479c-8193-6b8bfce9001c
    type: derived

What it detects

This rule flags PowerShell script content that creates a .NET NetworkInformation Ping object and calls its Send method. It is intended to catch attempts to move data over ICMP as an alternate exfiltration channel, using PowerShell to generate and transmit payloads through Ping-related networking APIs. Detection relies on Script Block Logging telemetry that records the PowerShell script block text for the presence of the specified PowerShell/.NET constructs.

Known false positives

Legitimate usage of System.Net.NetworkInformation.Ping class

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.