RedTail Linux malware ICMP reachability sweep - multiple hardcoded validation hosts pinged in burst
Detects rapid ICMP (ping) traffic directed towards specific internal and external hosts, characteristic of the RedTail Linux malware attempting to perform network discovery or validate connectivity to command-and-control infrastructure.
Suricata
