Anomalous use of ICMP or UDP by non-network service processes for data exfiltration or remote control, especially if traffic bypasses proxy infrastructure or shows unusual flow patterns.
| Data Component | Name | Channel |
|---|---|---|
| Network Connection Creation (DC0082) | WinEventLog:Sysmon | EventCode=3 |
| Network Traffic Content (DC0085) | NSM:Flow | ICMP/UDP traffic (Wireshark, Suricata, Zeek) |
| Field | Description |
|---|---|
| ProcessContextAllowList | Processes normally allowed to use ICMP/UDP (e.g., ping.exe, DNS resolver). |
| ByteTransferAnomalyThreshold | Suspicion if client sends much more data than it receives (e.g., >90%). |
| ProtocolUsageBaseline | Baseline which protocols are normal per host or segment (ICMP, UDP, etc.). |
ICMP or raw socket traffic generated by user-mode processes like bash, Python, or nc, typically using ping, hping3, or crafted packets via libpcap or scapy.
| Data Component | Name | Channel |
|---|---|---|
| Network Connection Creation (DC0082) | auditd:SYSCALL | sendto/connect |
| Network Traffic Content (DC0085) | NSM:Flow | icmp.log, weird.log |
| Field | Description |
|---|---|
| RawSocketExecutionPath | Uncommon programs using raw sockets (e.g., netcat, Python, nmap). |
| TimeWindow | Tunable window for correlating execution with network events (e.g., 2m). |
Unsigned binaries or interpreted scripts initiating non-standard protocols (ICMP, UDP, SOCKS) outside of baseline network behavior.
| Data Component | Name | Channel |
|---|---|---|
| Network Traffic Flow (DC0078) | macos:unifiedlog | com.apple.network |
| Network Traffic Content (DC0085) | NSM:Flow | ICMP/UDP monitoring (tcpdump, Wireshark, Zeek) |
| Field | Description |
|---|---|
| UnsignedBinaryNetworkUsage | Detection threshold for unsigned or transient binaries making ICMP/UDP calls. |
VMCI (Virtual Machine Communication Interface) traffic between guest and host, or between VMs, originating from non-management tools or unauthorized binaries.
| Data Component | Name | Channel |
|---|---|---|
| Network Traffic Content (DC0085) | esxi:vmkernel | VMCI syslog entries |
| Field | Description |
|---|---|
| VMCIBackdoorProcess | Monitor for non-vSphere or VMware-native processes using VMCI. |
| GuestToHostCommPattern | Baseline pattern of guest-to-host traffic vs anomaly (unexpected port, volume). |
Non-standard port/protocol pairings or low-entropy ICMP traffic resembling tunneling patterns (e.g., fixed-size pings with delays).
| Data Component | Name | Channel |
|---|---|---|
| Network Traffic Content (DC0085) | NSM:Firewall | ICMP/UDP protocol anomaly |
| Network Traffic Flow (DC0078) | NSM:Flow | conn.log, icmp.log |
| Field | Description |
|---|---|
| ProtocolEntropyThreshold | ICMP/UDP packet content entropy filter to identify encoded payloads. |
| SessionDurationThreshold | Long ICMP/UDP sessions beyond expected limits (e.g., >5min). |