Netomize Official Blog

Fair enough!

No, it is not the agent sending the first ICMP Echo Reply packet; it is the system's ICMP network stack. This is what I said in the article: "For example, when tunnelling an Echo Request packet, first the system's ICMP network stack responds with the same packet's data payload as an Echo Reply packet using the same sequence and identifier numbers, and the second Echo Reply packet is the tunnelling packet carrying the results of a given command, but using different identifier and sequence numbers." You can see it in the attached pcap traffic screenshot for packets 5, 6 and 7. Try it on your own, and let me know the results. I have no issue with your points on scalability.

Hi commSync, Thank you for taking the time to read the article and for your input. While I understand your pushback on the conclusion, the generalization and the ability to detect such tunnelling traffic using the PacketSmith Yara-X detection module without writing any script, and with relative ease, is a feat in itself. Your concerns about changing those constants in the code to bypass the detection logic are valid for much malware C&C traffic, except that in your case those constants are embedded in the code itself and are not provided in a separate configuration file. I reckon that a lot of threat actors, read-teamers, script kiddies, and general users of the tool would compile the code as is. For the ICMP rules, I could also generalize them so they do not account for asymmetric authentication logic, albeit at the expense of some false positives. With respect to the possibility of detecting the traffic by XOR-decrypting it (key-independent) on the fly, it is not "possible" since the data is VESQER-compressed before encryption. In the section “ICMP Detection Module”, we demonstrate how the PacketSmith ICMP detection module detects suspicious/malicious ICMP Echo traffic using behavioural and protocol-semantic analysis, independent of any hardcoded rule. Once again, thank you for your contribution to this article. Best regards, M.