Tips on hunting down ICMP exfiltration from Windows 10.

Have a Windows 10 PC that appears to be conducting ICMP exfiltration based on pfsense logs. Sending multiple consecutive ICMP packets to know bad recipients. MS Network Monitor does not display a process name. Neither NM nor wireshark give any meaningful payload data (assuming it is encrypted). Norton power eraser says nothing found, but no surprise there as they suck. Malwarebytes says the same.

My strong preference would be NOT to wipe the machine and start over but rather ferret …

cybersecurity down exfiltration hunting icmp tips windows windows 10