ICMP Tunneling - Large Echo Request Payload Anomaly (>64 bytes)

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•2

This rule detects ICMP Echo Request (type 8) packets with an unusually large payload (greater than 64 bytes). Such anomalies often indicate that an adversary is using ICMP as a covert channel for command-and-control (C2) communications or data exfiltration, by embedding arbitrary data within the ICMP payload fields.