NF – Don’t Fragment bit set – check for covert channel
The purpose of this rule is to potentially detect patterns associated with covert channels that abuse ICMP echo requests with the Don't Fragment bit set
ID Number
5016105
Signature
alert icmp $HOME_NET any -> $EXTERNAL_NET any (msg:"NF - Don't Fragment bit set - check for covert channel"; fragbits:D; itype:8; icode:0; detection_filter:track by_src, count 3, seconds 5; metadata:08122014; classtype:misc-activity; sid:5016105; rev:1;)
MITRE ATT&CK Technique
-
Severity
Low
Recommendations/Investigative actions
if the source and the destination are allowed to communicate - it's a false positive and can archive and baseline the alert. If one of them is an internet address - follow the instructions of "IP address in your network is suspected to be on the internet" playbook