Sign In
- Platform
- Solutions
- Modern NDR
- Resources
- Company
Platform
Modern NDR
Resources
Company
Platform
Modern NDR
Resources
Company
DETECTION OVERVIEW
Risk Factors
Ping scans are easy to run and have few disadvantages. After an attacker compromises a single workstation on a network, they can enumerate through host discovery, and then laterally move to other active workstations. However, ping scans are noisy and this type of malicious activity is easily detected, so hackers avoid these types of scans to avoid being caught.
The system might change the risk score for this detection.
Kill Chain
$source sent a high volume of $key ICMP requests to an unusually large group of unique and internal IP addresses across your network. This behavior indicates that $source might be compromised and performing a reconnaissance scan to discover active devices on the network.
Host discovery is one of the first steps taken during network reconnaissance, and can be easily done with a ping scan. An attacker might begin probing a subnet range for online hosts by sending an ICMP Echo Request (or ping) to each IP address on that subnet. Machines that reply with an ICMP Echo reply are considered active and can be targeted for further enumeration through tools such as Nmap Security Scanner.
Configure host-based or network-based firewalls to reject ICMP Echo traffic
Monitor ICMP traffic on your network for an unusual increase in ICMP traffic from distinct hosts
Implement network segmentation policies that restrict device communication to a limited number of peers
Network analysis and visibility solutions remain underrepresented in enterprises. Find out why in this preview of a new Wave report.
ExtraHop® Named a Leader in First-Ever Gartner® Magic Quadrant™ for Network Detection and Response
Visit this resource for more information.
This analysis exposes the critical link between an organization's lack of internal visibility and the escalating cost of compromise, demanding an urgent re-evaluation of how core business assets are protected.
Learn why you need to be wary of the claims certain network detection and response providers make about their coverage against the MITRE ATT&CK framework.
Learn how NDR from RevealX helps security teams detect and investigate more adversary TTPs in the MITRE ATT&CK framework than rule-based tools.
