Data Exfil using ICMP

ICMP is a network-layer protocol used for diagnostics and control. Because it is commonly allowed through firewalls and typically inspected less strictly than TCP/UDP, attackers sometimes abuse ICMP to tunnel and exfiltrate data. Malicious actors encode data into ICMP payloads (echo request/reply, timestamp, info) and send it to a remote listener under their control.

Common techniques for exfil

  • ICMP echo (type 8) / reply (type 0) tunneling: attackers place encoded (base64, hex) chunks of files inside ICMP payloads. The remote server collects and decodes them.

  • Custom ICMP types/codes: using uncommon ICMP types or non-zero codes to avoid signature-based detections.

  • Fragmentation and reassembly: large payloads are split across multiple packets.

  • Encryption/obfuscation: Encrypting or obfuscating payloads (base64 is common) to look like random data.

IOAs

  • Persistent ICMP sessions to an external host not used for legitimate monitoring.

  • Unusually large ICMP payloads or frequent ICMP with payload > typical ping size.

  • ICMP payloads that contain high-entropy data or patterns consistent with base64/hex.

  • Bursts of ICMP are immediately followed by no other legitimate application traffic from the same host.

Last updated