Elastic high stable kql

ICMP Redirect Message from Internal Host

Identifies ICMP Redirect messages (type 5 for IPv4, type 137 for IPv6) sourced from an internal IPv4 or IPv6 address. Legitimate redirects are normally sent only by on-path routers. A workstation or server emitting redirects can indicate route manipulation for adversary-in-the-middle activity.

View Source

Detection Logic

data_stream.dataset:network_traffic.icmp
  and (network_traffic.icmp.request.type:(5 or 137) or icmp.request.type:(5 or 137))
  and source.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16 or "FC00::/7" or "FE80::/10")

Field Validations

Loading…

Comments (0)

Loading comments...