Raw-socket or ICMP tunnelling utility executed on Linux

Siemphony@siemphonymediumT1095unverified

AN1255's tool-execution leg: an auditd SYSCALL record whose `exe` is one of the utilities that craft raw ICMP or raw-socket packets by hand — hping and hping3, the nmap suite's nping, and the ptunnel / ptunnel-ng / pingtunnel / icmptunnel family that carries a TCP session inside ICMP echo payloads. MITRE's `RawSocketExecutionPath` knob names "uncommon programs using raw sockets" as the thing to baseline; the binary list here is authored, not MITRE's, and covers compiled tools only. What this rule deliberately does not do is look at traffic. Every packet-level observable the strategy describes is a statistic: AN1254's `ByteTransferAnomalyThreshold` is a sent/received ratio, AN1258's `ProtocolEntropyThreshold` and `SessionDurationThreshold` are an entropy measure and a duration comparison, and `ProtocolUsageBaseline` is a per-host baseline. lib/sigma has no aggregation, no numeric comparison and no timeframe, so none of them can be stated, and a per-event rule over the Zeek legs would reduce to "an ICMP flow exists", which every ping and every monitoring probe satisfies. The Windows arm is in worse shape than it looks: Sysmon EventID 3 records TCP and UDP connections only and never emits an ICMP event at all, so the ICMP half of AN1254 has no Windows telemetry behind it — which is why this rule sits on the Linux source. Two blind spots inside the source it does use. auditd's `exe` names the file that was executed, so an implant that opens a raw socket from scapy or a Python script records `/usr/bin/python3` and never matches, and a renamed or dropped-in copy of hping3 matches nothing either. Prerequisite: auditd records none of this by default — the rule returns zero rows until a syscall rule such as `-a always,exit -F arch=b64 -S execve -k exec` is loaded, and zero rows reads as quiet when it actually means blind. If the loaded ruleset audits more than execve, one run of these tools emits several matching SYSCALL records rather than one. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0457, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 3 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Splunk · SPL

Run this as a search.

index=* (type="SYSCALL" AND (exe="*/hping" OR exe="*/hping2" OR exe="*/hping3" OR exe="*/nping" OR exe="*/ptunnel" OR exe="*/ptunnel-ng" OR exe="*/pingtunnel" OR exe="*/icmptunnel"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (TO_LOWER(type) == "syscall" AND (TO_LOWER(exe) LIKE "*/hping" OR TO_LOWER(exe) LIKE "*/hping2" OR TO_LOWER(exe) LIKE "*/hping3" OR TO_LOWER(exe) LIKE "*/nping" OR TO_LOWER(exe) LIKE "*/ptunnel" OR TO_LOWER(exe) LIKE "*/ptunnel-ng" OR TO_LOWER(exe) LIKE "*/pingtunnel" OR TO_LOWER(exe) LIKE "*/icmptunnel"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,linux,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for linux so this only evaluates relevant events. -->    <field name="type" type="pcre2">(?i)^SYSCALL$</field>    <field name="exe" type="pcre2">(?i)(/hping$|/hping2$|/hping3$|/nping$|/ptunnel$|/ptunnel-ng$|/pingtunnel$|/icmptunnel$)</field>    <description>Raw-socket or ICMP tunnelling utility executed on Linux</description>    <mitre>      <id>T1095</id>    </mitre>  </rule></group>

Sentinel · KQL

Run this as a search.

Sentinel cannot express this construct. No Sentinel table is modelled for this logsource ({"product":"linux","service":"auditd"}), so there is nothing honest to query. Pick a logsource this translator maps, or write the KQL by hand. The Sigma source is on the first tab, unchanged.

At a glance

Logsource: auditd / linux
Level: medium
Category: reverse_shell
Sigma status: experimental
Backends: 3 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 37cb66b0-400b-4f49-a934-8a58967310f2

ATT&CKT1095

T1095Non-Application Layer Protocol

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonreverse shell

reverse shellAI draft — unreviewed

01 · What this rule detects

AN1255 describes ICMP and raw-socket traffic generated by user-mode processes. This rule takes only the execution half of that: an auditd SYSCALL record whose exe is one of eight compiled packet-crafting or ICMP-tunnelling binaries — hping, hping2, hping3, nping, and the ptunnel / ptunnel-ng / pingtunnel / icmptunnel family. It is a tool-presence signal, not a traffic signal: it fires when someone runs the tool, whether or not a packet leaves. Everything packet-level in DET0457 was left out deliberately. AN1254's ByteTransferAnomalyThreshold is a sent/received ratio, AN1258's ProtocolEntropyThreshold and SessionDurationThreshold are an entropy measure and a duration comparison, and ProtocolUsageBaseline is a per-host baseline. lib/sigma has no aggregation, no numeric comparison and no timeframe, so none of them can be stated. A per-event rule over the Zeek icmp leg would collapse into "an ICMP flow exists", which every ping satisfies. The Windows arm is worse than it looks: Sysmon EventID 3 records TCP and UDP only and never emits an ICMP event, so AN1254's ICMP half has no Windows telemetry behind it at all.

02 · Telemetry you need

product: linux, service: auditd, taken verbatim from AN1255. The prerequisite is the first thing to check: auditd records no execve by default. Until a syscall rule such as -a always,exit -F arch=b64 -S execve -k exec is loaded, this rule returns zero rows — and zero rows reads as quiet when it means blind. If the loaded ruleset audits more than execve, one run of hping3 emits several matching SYSCALL records rather than one.

03 · How the logic works

One selection, both keys required:

type: 'SYSCALL' stops the PATH and CWD records of the same event from each counting separately. The eight-entry list is the pipeline's own; MITRE names only the knob — RawSocketExecutionPath, "uncommon programs using raw sockets" — and ships no binaries. exe holds the file actually executed, which is why the list covers compiled tools only: a scapy or Python implant opening a raw socket records /usr/bin/python3 and never matches, and a renamed or dropped-in copy of hping3 matches nothing either.

04 · Common false positives

Network and firewall engineers run hping3 exactly the way an adversary does — same binary, same arguments, separated only by who ran it and on which host. Load, latency and failover harnesses that loop hping3 to measure packet loss produce bursts on lab and staging boxes. Authorised penetration tests and security CI install this tooling onto ephemeral hosts on purpose. One caveat on the rule's own false-positive list: review found the "nmap-suite scanning" entry does not hold, because an nmap sweep execs nmap or ping, never nping. Treat nping matches as genuinely rare, not as expected scanner noise.

05 · Detection maturity

tier_1: , and it stays there. UNVERIFIED — derived from DET0457 and never run against a log line. level: medium is calibrated against the engineer-testing false positive, not against observed volume.
tier_2: starts by confirming the auditd ruleset is loaded and learning which of the eight binaries exist in the estate at all;
tier_3: needs the flow analytics the strategy leans on, which need a platform that can aggregate.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Baseline which hosts legitimately carry these binaries at all — that is what RawSocketExecutionPath is asking of you. Exclude jump hosts and network-test systems by host, not by user, since the same engineers work from everywhere. Add any locally packaged tunneller to the list. At triage, read the auditd auid alongside uid so an operator's run separates from a service account's, and pair a hit with flow data if you have Zeek, since this rule cannot see whether anything was actually sent.

Declared by the author

Network and firewall engineers running hping3 from a jump host to test an ACL, probe path MTU or reproduce a packet-loss report. It is the same binary with the same arguments as the abuse case, separated only by who ran it and on which host.
Scanning and availability monitoring built on the nmap suite, which ships nping. A scheduled discovery or reachability check makes this the steadiest source of matches in most estates, and the scanner hosts should be excluded before the rule is promoted above medium.
Load, latency and failover test harnesses that call hping3 in a loop to measure packet loss or flood a link, producing bursts of matching records on the lab or staging hosts that run them.
Authorised penetration tests and security CI pipelines that install hping3 or the ptunnel family onto ephemeral hosts as part of a scheduled exercise, which is exactly the tooling this rule was written to find.

Noise check0 of 5 fired

Fires on none of the 5 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 5 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1095, evaluated against their — events.

Share this rule

/u/siemphony/37cb66b0-400b-4f49-a934-8a58967310f2

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Raw-socket or ICMP tunnelling utility executed on Linux

The detection

detection.yml

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Sentinel · KQL

Community

Verdicts from engineers who deployed it