Most network monitoring watches web, mail and DNS traffic. MITRE ATT&CK Non-Application Layer Protocol (T1095) is about the traffic that sits beneath all of that. It is a command and control technique and applies to ESXi, Linux, macOS, Network Devices and Windows.
How attackers use it
MITRE says adversaries may use a non-application layer protocol, in OSI terms, for communication between a host and a C2 server, or among infected hosts. The list is long. MITRE gives these examples:
- network layer protocols such as ICMP,
- transport layer protocols such as UDP,
- session layer protocols such as SOCKS,
- redirected or tunneled protocols such as Serial over LAN (SOL).
ICMP is the featured example. Every IP compatible host must implement it, but it is less commonly monitored than TCP or UDP, so adversaries may use it to hide communication.
The ESXi case is a different kind of hiding. Adversaries may use the Virtual Machine Communication Interface (VMCI) for traffic between guest VMs and the ESXi host. This traffic stays on the physical machine and does not cross routers or switches. MITRE says that makes it invisible to external monitoring and standard tools such as tcpdump, netstat, nmap and Wireshark. With a VMCI backdoor on a compromised ESXi host, adversaries may regain access from any guest VM regardless of network segmentation or firewall rules.
How to detect it
MITRE's strategy (DET0457) lists:
- Anomalous use of ICMP or UDP by processes that are not network services, especially where traffic bypasses proxy infrastructure or has unusual flow patterns.
- ICMP or raw socket traffic generated by user mode processes such as bash, Python or nc, including ping, hping3 or packets crafted with libpcap or scapy.
- Unsigned binaries or interpreted scripts starting non-standard protocols such as ICMP, UDP or SOCKS outside baseline behavior.
- VMCI traffic between guest and host, or between VMs, that comes from non-management tools or unauthorized binaries.
- Non-standard port and protocol pairings, or low entropy ICMP traffic that looks like tunneling, for example fixed size pings sent with delays.
The ICMP signals are mostly about shape. Normal ping is small, infrequent and from a few sources. A tunnel tends to send regular, similar sized packets, sometimes with larger payloads than needed. Flow data and firewall logs that record ICMP type, size and volume per host are the data to collect.
How to reduce the risk
MITRE lists four mitigations:
- Audit. Periodically check ESXi hosts for open VMCI ports. MITRE says running lsof -A and inspecting results for type SOCKET_VMCI will show processes with open VMCI ports.
- Filter Network Traffic. Block protocols that are not needed across the network boundary. If VMCI is not required in ESXi environments, consider restricting guest VMs from accessing VMCI services.
- Network Intrusion Prevention. Use network detection and prevention systems with signatures for specific adversary malware.
- Network Segmentation. Configure firewalls and proxies so outgoing traffic is limited to necessary ports and goes through proper gateways. Provision hosts to communicate only over authorized interfaces.
Check your own environment
- Does your egress policy allow ICMP out to the whole internet? Does it need to?
- Do you log ICMP and UDP flows with byte counts per host?
- Do you know which ESXi guests may use VMCI, and is it needed?
- Which servers should never send anything except to a few known destinations?
On an ESXi host, the check MITRE describes can be run from the shell by an administrator:
lsof -A | grep SOCKET_VMCI
Open VMCI sockets are not automatically malicious. Investigate processes you cannot account for.
On Linux, a read-only look at who is sending ICMP right now needs packet capture. A simpler first step is to check your firewall's counters for ICMP rules, as part of a review of egress policy.
Quick check
Why can ICMP be useful to an adversary?
All IP compatible hosts implement it, yet it is less commonly monitored than TCP or UDP, so traffic can hide in it.
Why does VMCI traffic escape network monitoring?
It stays inside the physical ESXi machine and does not traverse routers or switches, so external tools cannot see it.
Sources
- MITRE ATT&CK, T1095 Non-Application Layer Protocol: https://attack.mitre.org/techniques/T1095/
