ICMP Tunnel C2 - Oversized Payload

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•8

This rule detects potential ICMP tunnel command and control (C2) activity by identifying ICMP echo requests (type 8) with an unusually large data payload (greater than 100 bytes). It uses a threshold to alert if more than 20 such packets are observed from the same source IP within a 60-second window, indicating sustained communication that might be indicative of data exfiltration or C2.