Lion Cipher Lab
Hunt a covert ICMP exfiltration channel in a packet capture
- Threat Intel Analyst
- Intermediate
- ~60 min
- Free · no account required
Why it matters
ICMP — the protocol behind ping — is almost always allowed outbound. Firewalls that would block a raw upload in a heartbeat happily pass echo requests, and an echo request carries a payload the sender fills with whatever it likes. A standard ping fills that payload with a fixed, predictable filler of a fixed size; an attacker fills it with chunks of a stolen file instead, and the traffic still looks like someone running ping. That makes ICMP a classic non-application-layer covert channel (MITRE ATT&CK T1095) used for exfiltration over an alternative protocol (T1048). The giveaway is the…
What you'll learn
- explaining how ICMP echo (ping) can be abused as a covert exfiltration channel — MITRE ATT&CK T1095 and T1048
- describing the libpcap file format: global header, per-packet records, and the Ethernet/IPv4/ICMP headers inside each frame
- building a synthetic pcap by hand with Python's struct module — no scapy, no pip, no network
- parsing a pcap with pure Python stdlib and extracting ICMP echo-request payloads
- computing Shannon entropy (bits/byte) to tell boring ping filler from encrypted/compressed data
- scoring packets on payload SIZE, ENTROPY, and per-destination DATA VOLUME against a baseline
- measuring a detection against ground truth and tuning the entropy/size threshold
- judgment: why a patient low-and-slow attacker evades size+entropy, and the real mitigations (egress filtering, per-host baselining, deep inspection)
Steps in this lab
- What you're hunting: ICMP echo as a covert channel
- What a NORMAL ping looks like (so you know the baseline)
- Shannon entropy in one paragraph (your sharpest tool)
- The pcap file format, so you can build and parse one
- Build the synthetic capture (make_capture.py)
- Write the hunter (hunt.py)
- Read the real numbers — baseline vs covert
- Tune the threshold and measure the catch
- The honest negative — low-and-slow defeats size+entropy
- The real mitigations — what actually closes the gap
- How a pro does this better