ICMP Covert Channel Tunneling Large Payload Exfiltration

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•2

Detects anomalous ICMP Echo Request packets (type 8, code 0) that contain payloads exceeding 64 bytes. ICMP Echo requests with large, non-standard payloads are a classic indicator of ICMP tunneling, which can be used to bypass network firewalls and encapsulate non-ICMP traffic for command and control (C2) or data exfiltration. The rule includes a threshold to reduce noise by alerting only when multiple such packets are seen from the same source.