Windows PowerShell ICMP Exfiltration via Ping and Socket Send

Alerts on PowerShell that instantiates System.Net.NetworkInformation.Ping and calls .Send, consistent with ICMP-based exfiltration.

FreeReviewedSigma · Medium · v2

Product: windows
Category: ps_script
Author: Bartlomiej Czyz @bczyz1, oscd.community (SigmaHQ), DRL 1.1
Published: 2020-10-10
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Exfiltration

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
- T1048.003Exfiltration Over Unencrypted Non-C2 Protocol
Impact

What it detects

This rule identifies PowerShell script content that instantiates System.Net.NetworkInformation.Ping and then performs a network send operation, consistent with attempting data exfiltration over ICMP or ICMP-adjacent activity. Attackers may use alternative, unencrypted protocols to bypass controls that focus on expected command-and-control or data paths. Telemetry relies on PowerShell Script Block Logging capturing ScriptBlockText that includes the relevant class and send method usage.

Reporting behind it

Related detections9 linkedT1048.003 — drag to rearrange

FTP Data Exfiltration via curl with Embedded Credentials

Suspicious Data Exfiltration via TFTP Client

Suspicious Finger Client Execution for Command and Control

Malicious dnscat2 DNS Tunneling C2 Traffic

Suspicious Data Transfer via curl to Raw IP Address

Linux Python CLI Web Server Execution via http.server or SimpleHTTPServer

Windows svchost.exe Spawning rundll32.exe with WebDav davclnt.dll DavSetCookie

PowerShell Script Exfiltration Attempt: Send-MailMessage with Attachments

Windows Suspicious Outbound SMTP Connections on Common Mail Ports

Windows PowerShell ICMP Exfiltration via Ping and Socket Send

Pivot detection · T1048.003 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

powershell-icmp-exfiltration-via-ping-send-4c4af3cd

title: Windows PowerShell ICMP Exfiltration via Ping and Socket Send
id: 56b77a90-eb44-4834-a531-5194ffe74573
status: test
description: This rule identifies PowerShell script content that instantiates System.Net.NetworkInformation.Ping and then performs a network send operation, consistent with attempting data exfiltration over ICMP or ICMP-adjacent activity. Attackers may use alternative, unencrypted protocols to bypass controls that focus on expected command-and-control or data paths. Telemetry relies on PowerShell Script Block Logging capturing ScriptBlockText that includes the relevant class and send method usage.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1048.003/T1048.003.md#atomic-test-2---exfiltration-over-alternative-protocol---icmp
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_icmp_exfiltration.yml
author: Bartlomiej Czyz @bczyz1, oscd.community, Huntrule Team
date: 2020-10-10
modified: 2022-12-25
tags:
  - attack.exfiltration
  - attack.t1048.003
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|contains|all:
      - New-Object
      - System.Net.NetworkInformation.Ping
      - .Send(
  condition: selection
falsepositives:
  - Legitimate usage of System.Net.NetworkInformation.Ping class
level: medium
license: DRL-1.1
related:
  - id: 4c4af3cd-2115-479c-8193-6b8bfce9001c
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL