Analytics Low
✕

Abnormal ICMP echo (PING) to multiple hosts

An endpoint performed an abnormal ICMP echo (PING) to multiple hosts on the network.

Module:
Platform Analytics
Data source:
XDR Agent
ATT&CK tactics: Discovery (TA0007)
ATT&CK techniques: Remote System Discovery (T1018)
Attacker's goals:

An adversary may use the ICMP protocol to map IP addresses, hostnames and segments to plan its lateral movement over the network.

Investigative actions:

Verify if the host is a newly deployed host. Verify if newly services or applications that require network mapping were installed on the initiating host.

Test period:
5 Hours
Deduplication:
2 Days