Data Exfiltration via ICMP

---

ICMP is a network-layer protocol used for diagnostics and control (e.g., ping, TTL exceeded). Because it is commonly allowed through firewalls and typically inspected less strictly than TCP/UDP, attackers sometimes abuse ICMP to tunnel and exfiltrate data. Malicious actors encode data into ICMP payloads (echo request/reply, timestamp, info) and send it to a remote listener under their control.

How adversaries use ICMP for exfiltration

Common techniques:

• ICMP echo (type 8) / reply (type 0) tunneling: attackers place encoded (base64, hex) chunks of files inside ICMP payloads. The remote server collects and decodes them.
• Custom ICMP types/codes: using uncommon ICMP types or non-zero codes to avoid signature-based detections.
• Fragmentation and reassembly: large payloads are split across multiple packets.
• Encryption/obfuscation: Encrypting or encrypting payloads (base64 is common) to look like random data.

Indicators that something may be malicious:

• Persistent ICMP sessions to an external host not used for legitimate monitoring.
• Unusually large ICMP payloads or frequent ICMP with payload > typical ping size.
• ICMP payloads that contain high-entropy data or patterns consistent with base64/hex.
• Bursts of ICMP are immediately followed by no other legitimate application traffic from the same host.

Indicators of Attack in Wireshark

Look for the following in a pcap when inspecting in Wireshark:

• ICMP packet volumes: a single host sending many ICMP echo requests to an external IP.
• Large frame.len or icmp.payload: pings with payloads much larger than typical (e.g., > 64 bytes). 
• ICMP type/code unusual values: e.g., unusual use of timestamp(13/14) or custom codes.
• Regular timing (periodicity): evenly spaced ICMP packets carrying similar-sized payloads.
• Fragments with reassembly: multiple ICMP fragments from the same src/dst pair.

Analyze with Wireshark

• Filter for ICMP packets
• Look for unusually frequent or large ICMP Echo Requests/Replies
  • icmp
• Isolate Echo Request packets (or other types)
  • icmp.type == 8
• Examine large ICMP packets
  • Normal pings are ~74 bytes
  • Anything over 100 bytes is suspicious
  • e.g., icmp.type == 8 && frame.len > 100
• Look at data