Suspicious ICMP packet

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	Requires one of the following data sources: Palo Alto Networks Firewall EAL Logs OR XDR Agent
ATT&CK Tactic	Command and Control (TA0011)
ATT&CK Technique	Protocol Tunneling (T1572)
Severity	Low

Description

An ICMP router advertisement was sent by a host.

Attacker's Goals

Make the victim change his routing table.

Investigative actions

Investigate why the source host sent an ICMP router advertisement and if it changed the destination target routing table.

Variations

Suspicious ICMP packet that resemble an ICMP redirect attack

Synopsis

Field	Value
ATT&CK Tactic	Command and Control (TA0011)
ATT&CK Technique	Protocol Tunneling (T1572)
Severity	Informational

Description

ICMP redirect was sent by a user.

Attacker's Goals

Make the victim change his routing table.

Investigative actions

Investigate why the source host sent an ICMP router advertisement and if it changed the destination target routing table.