Detect ICMP-Ghost Implant ICMP and DNS Tunnelling C2 Traffic Using PacketSmith Yara-X & ICMP Detection Modules
Source Reddit BlueTeam
Discussion
ICMP-Ghost is an open-source tunnelling framework that uses ICMP and DNS protocols for command and control (C2) communication. It is designed in x64 assembly and claims to evade endpoint detection and network intrusion detection systems. The framework supports dual-channel C2 with the ability to switch between ICMPv4 and DNS tunnelling on the fly. Detection rules using PacketSmith Yara-X modules have been developed to identify traffic generated by this framework.
r/blueteamsec (opens in a new tab)u/MFMokbel0 points0 comments
ICMP-Ghost is an open-source tunnelling framework written in pure x64 assembly. What stands out about this framework, compared to other closed- and open-source ones, is the author's claims about its EDR evasion and Suricata IDS/IPS evasion capabilities. The framework supports a dual-channel C2 architecture (despite the exclusivity of the "ICMP" in the framework title), including ICMPv4 and DNS, with the ability to switch between them on the fly. The author makes some grandiose claims about its architecture and design with respect to performance, efficiency, endpoint and network evasion, and memory footprint.
Despite the author's claims, in this article, we detail the structures of each of the C2 protocols, along with PacketSmith Yara-X detection module rules for detecting the traffic of both C2 channels.