ATT&CK T1018 - ICMP Ping Sweep for Host Discovery

Darshan Thummar@Mighty

•updated Jun 10, 2026•1•0•5

This rule detects an ICMP ping sweep for host discovery, a technique used by attackers to identify active hosts on a network. It triggers when more than 20 ICMP echo requests (type 8) are sent from a single source within a 10-second window to the home network.