ATT&CK T1018 - ICMP Ping Sweep for Host Discovery
This rule detects an ICMP ping sweep, which is a common technique used for host discovery within a network. It triggers an alert if more than 20 ICMP echo requests (type 8) are observed from a single source IP within a 10-second window, targeting the home network. This behavior is indicative of an attacker attempting to map out active hosts on the network.
Suricata
