PowerShell ICMP Exfiltration Attempt

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•18

Detects PowerShell script blocks attempting to exfiltrate data using ICMP by creating a System.Net.NetworkInformation.Ping object and sending data. This method allows adversaries to bypass traditional network controls by tunneling data over ICMP.