Create icmp.rules

Contains the snort rules to identify the default start/end of the exfil.