NF – Echo Request Payload – Bigger than 100 bytes
The rule detects ICMP Echo Request packets with a payload size larger than 100 bytes. ICMP Echo Request packets are typically used to check the reachability of a host and a larger payload in such requests may indicate potential abnormal or suspicious behavior, which could be worth investigating.
ID Number
5016111
Signature
alert icmp any any -> any any (msg:"NF - Echo Request Payload - Bigger than 100 bytes"; icode:0; itype:8; dsize:>100; reference:url,networkforensic.dk; metadata:25032019; classtype:misc-activity; sid:5016111; rev:1;)
MITRE ATT&CK Technique
-
Severity
Low
Recommendations/Investigative actions
Authorize the Link. If the link was approved - archive and baseline the rule. If not - check the connection and investigate the relevant IP address.