huntrule

Windows PowerShell ICMP Exfiltration via Ping and Socket Send

Alerts on PowerShell that instantiates System.Net.NetworkInformation.Ping and calls .Send, consistent with ICMP-based exfiltration.

FreeReviewedSigma · Medium · v2
Product
windows
Category
ps_script
Author
Bartlomiej Czyz @bczyz1, oscd.community (SigmaHQ), DRL 1.1
Published
2020-10-10
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Exfiltration

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule identifies PowerShell script content that instantiates System.Net.NetworkInformation.Ping and then performs a network send operation, consistent with attempting data exfiltration over ICMP or ICMP-adjacent activity. Attackers may use alternative, unencrypted protocols to bypass controls that focus on expected command-and-control or data paths. Telemetry relies on PowerShell Script Block Logging capturing ScriptBlockText that includes the relevant class and send method usage.

Reporting behind it

Related detections9 linkedT1048.003 — drag to rearrange
FTP Data Exfiltration via curl with Embedded Credentials
Suspicious Data Exfiltration via TFTP Client
Suspicious Finger Client Execution for Command and Control
Malicious dnscat2 DNS Tunneling C2 Traffic
Suspicious Data Transfer via curl to Raw IP Address
Linux Python CLI Web Server Execution via http.server or SimpleHTTPServer
Windows svchost.exe Spawning rundll32.exe with WebDav davclnt.dll DavSetCookie
PowerShell Script Exfiltration Attempt: Send-MailMessage with Attachments
Windows Suspicious Outbound SMTP Connections on Common Mail Ports
Windows PowerShell ICMP Exfiltration via Ping and Socket Send
Pivot detection · T1048.003 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.