ICMP Redirect Message from Internal Host

Last updated 2 months ago on 2026-06-25

Created 2 months ago on 2026-06-25

About

Identifies ICMP Redirect messages (type 5 for IPv4, type 137 for IPv6) sourced from an internal IPv4 or IPv6 address. Legitimate redirects are normally sent only by on-path routers. A workstation or server emitting redirects can indicate route manipulation for adversary-in-the-middle activity.

Tags

Domain: NetworkTactic: Credential AccessUse Case: Threat DetectionUse Case: Network Security MonitoringData Source: Network TrafficLanguage: kuery

Severity

high

Risk Score

MITRE ATT&CK™

Credential Access (TA0006)(external, opens in a new tab or window)

↳ Adversary-in-the-Middle (T1557)(external, opens in a new tab or window)

License

Elastic License v2(external, opens in a new tab or window)

Definition

Rule Type: Query (Kibana Query Language)
Integration Pack: Prebuilt Security Detection Rules
Index Patterns: logs-network_traffic.icmp-*
Related Integrations: network_traffic(external, opens in a new tab or window)
Query

✄𐘗text code block:
✄𐘗data_stream.dataset:network_traffic.icmp
  and (network_traffic.icmp.request.type:(5 or 137) or icmp.request.type:(5 or 137))
  and source.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16 or "FC00::/7" or "FE80::/10")

Install detection rules in Elastic Security

Detect ICMP Redirect Message from Internal Host in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).