Suspicious PowerShell ICMP Exfiltration (via ps_script)

title: Suspicious PowerShell ICMP Exfiltration (via ps_script)
id: 8a13a2ec-17fe-5eff-ab34-073ed8ef33f0
status: stable
description: This rule detects Exfiltration Over Alternative Protocol - ICMP. Threat actors may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel.
references:
    - https://attack.mitre.org/techniques/T1048/003/
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1048.003/T1048.003.md#atomic-test-2---exfiltration-over-alternative-protocol---icmp
author: 'Huntrule Team'
date: 2026-05-30
tags:
    - attack.exfiltration
    - attack.t1048.003
logsource:
    product: windows
    category: ps_script
    definition: 'Requirements: Script Block Logging must be enabled'
detection:
    selection:
        ScriptBlockText|contains|all:
            - 'New-Object'
            - 'System.Net.NetworkInformation.Ping'
            - '.Send('
    condition: selection
falsepositives:
    - Unknown
level: medium