<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: detecting-covert-channels
description: >-
  Detect covert communication channels embedded in network protocols including ICMP
  tunneling, HTTP header steganography, DNS covert channels, TCP sequence number encoding,
  and timing-based channels using Zeek, Suricata, and statistical analysis.
domain: cybersecurity
subdomain: network-security
tags:
  - covert-channel
  - icmp-tunnel
  - steganography
  - exfiltration
  - zeek
  - suricata
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  mitre-attack: ["T1572", "T1071", "T1048"]
  nist-csf: ["DE.CM-1", "DE.AE-3", "DE.AE-5"]
  uuid: a1b2c3d4-1008-4a00-b008-f00d00000008
---

# Detecting Covert Channels

## Overview

Covert channels hide data within legitimate network protocols to bypass security controls.
Attackers embed C2 commands and exfiltrated data in ICMP payloads, HTTP headers, DNS
queries, TCP/IP header fields, and timing intervals. Detection requires protocol anomaly
analysis, payload entropy measurement, and traffic pattern correlation. This skill covers
ICMP tunnel detection, HTTP steganography identification, protocol field abuse, and
timing channel analysis.

Mode: `[MODE: BLUE]` for detection; `[MODE: PURPLE]` for coverage validation.

## Prerequisites

| Requirement | Details |
|---|---|
| Zeek 6.0+ with protocol analyzers | Required |
| Suricata 7.0+ with deep packet inspection | Required |
| tcpdump/tshark for packet-level analysis | Required |
| Python 3.10+ for statistical analysis | Required |
| Baseline of normal protocol behavior for your network | Required |

## Key Concepts

### ICMP Tunnel Detection

```bash
# Detect large ICMP payloads (normal ping is 64 bytes)
tshark -r capture.pcap -Y "icmp && frame.len > 100" \
  -T fields -e ip.src -e ip.dst -e frame.len -e data.len

# Count ICMP packets per source (tunnels have high volume)
tshark -r capture.pcap -Y "icmp" -T fields -e ip.src | sort | uniq -c | sort -rn
```

### Suricata Covert Channel Rules

```
# Detect ICMP tunnel — oversized payload
alert icmp $HOME_NET any -> $EXTERNAL_NET any ( \
  msg:"Covert Channel - oversized ICMP payload (possible tunnel)"; \
  dsize:>100; \
  threshold:type both, track by_src, count 10, seconds 60; \
  classtype:bad-unknown; \
  sid:3001060; rev:1; \
  metadata:mitre_attack_technique T1572;)

# Detect ICMP tunnel — high frequency echo requests
alert icmp $HOME_NET any -> $EXTERNAL_NET any ( \
  msg:"Covert Channel - high frequency ICMP echo"; \
  itype:8; \
  threshold:type both, track by_src, count 100, seconds 60; \
  sid:3001061; rev:1;)

# Detect HTTP header covert channel — unusual header fields
alert http $HOME_NET any -> $EXTERNAL_NET any ( \
  msg:"Covert Channel - suspicious custom HTTP header"; \
  flow:established,to_server; \
  http.header; pcre:"/^X-[A-Za-z0-9]{20,}:\s*[A-Za-z0-9+\/=]{50,}/m"; \
  sid:3001062; rev:1;)

# Detect TCP urgent pointer abuse
alert tcp $HOME_NET any -> $EXTERNAL_NET any ( \
  msg:"Covert Channel - TCP urgent pointer set without URG data"; \
  flags:U; \
  threshold:type both, track by_src, count 5, seconds 300; \
  sid:3001063; rev:1;)
```

### Zeek Covert Channel Detection

```zeek
# icmp-tunnel-detect.zeek — detect ICMP covert channels
@load base/protocols/conn

module CovertChannel;

export {
    redef enum Notice::Type += {
        ICMP_Tunnel_Suspected,
        HTTP_Covert_Header,
    };
    const icmp_payload_threshold = 100 &redef;
    const icmp_volume_threshold = 50 &redef;
}

global icmp_tracker: table[addr] of count = {} &default=0 &create_expire=5min;

event icmp_sent(c: connection, icmp: icmp_conn) {
    ++icmp_tracker[c$id$orig_h];
    if ( icmp_tracker[c$id$orig_h] > icmp_volume_threshold ) {
        NOTICE([$note=ICMP_Tunnel_Suspected,
                $msg=fmt("High ICMP volume from %s: %d packets",
                         c$id$orig_h, icmp_tracker[c$id$orig_h]),
                $conn=c]);
    }
}
```

### Timing Channel Analysis

```bash
# Extract inter-packet timing for analysis
tshark -r capture.pcap -Y "ip.src == 10.0.0.50" \
  -T fields -e frame.time_relative | \
  awk 'NR>1{print $1-prev}{prev=$1}' > timing_deltas.txt

# Statistical analysis of timing regularity
# High regularity in timing suggests machine-generated covert channel
```

## Workflow

### Step 1: Identify Protocol Anomalies

Baseline normal protocol behavior. Flag deviations in payload size, frequency, and entropy.

### Step 2: Deploy Detection Rules

Load Suricata rules and Zeek scripts targeting covert channel indicators.

### Step 3: Analyze Payloads

```bash
# Check Suricata alerts
cat /var/log/suricata/eve.json | \
  jq 'select(.alert.signature | contains("Covert Channel"))'

# Extract ICMP payloads for manual analysis
tshark -r capture.pcap -Y "icmp" -T fields -e data | head -20
```

### Step 4: Correlate and Confirm

Cross-reference timing, volume, and entropy anomalies to confirm covert channel use.

## Detection

```yaml
title: Covert Channels Detection
id: 10cd37b2-db98-48af-bf15-d24b87384ff5
status: experimental
description: Detects suspicious activity related to detecting covert channels techniques in network security context
logsource:
  category: firewall
  product: linux
detection:
  selection:
    Action: blocked
  condition: selection
level: medium
tags:
  - attack.t1572
  - attack.t1071
  - attack.t1048
  - attack.command_and_control
falsepositives:
  - Network monitoring tools performing scheduled connectivity checks
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Covert Channels Detection | linux/firewall | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1572, T1071, T1048 |

## Verification

- [ ] ICMP tunnel (ptunnel, icmpsh) detected within 60 seconds
- [ ] HTTP header steganography flagged
- [ ] TCP covert channels detected (urgent pointer, sequence number encoding)
- [ ] False positive rate under 1% for ICMP payload rules
- [ ] Timing analysis identifies non-human patterns
- [ ] Alerts correlated with endpoint telemetry

## References

- [Zeek ICMP Analysis](https://docs.zeek.org/en/current/scripts/base/bif/plugins/Zeek_ICMP.events.bif.zeek.html)
- MITRE ATT&CK T1572 — Protocol Tunneling
- SANS SEC503: Intrusion Detection In-Depth
- Covert Channel Analysis and Detection (NIST)
