Cross-source coverage

T1498.001 / ATT&CK

Network Denial of Service: Direct Network Flood

2 rules across 2 sources.

From MITRE ATT&CK 19.2

Adversaries may attempt to cause a denial of service (DoS) by directly sending a high-volume of network traffic to a target. This DoS attack may also reduce the availability and functionality of the targeted system(s) and network. Direct Network Floods are when one or more systems are used to send a high-volume of network packets towards the targeted service's network. Almost any network protocol may be used for flooding. Stateless protocols such as UDP or ICMP are commonly used but stateful protocols such as TCP can be used as well.

Botnets are commonly used to conduct network flooding attacks against networks and services. Large botnets can generate a significant amount of traffic from systems spread across the global Internet. Adversaries may have the resources to build out and control their own botnet infrastructure or may rent time on an existing botnet to conduct an attack. In some of the worst cases for distributed DoS (DDoS), so many systems are used to generate the flood that each one only needs to send out a small amount of traffic to produce enough volume to saturate the target network. In such circumstances, distinguishing DDoS traffic from legitimate clients becomes exceedingly difficult. Botnets have been used in some of the most high-profile DDoS flooding attacks, such as the 2012 series of incidents that targeted major US banks.

Tactics
Impact
Platforms
Windows · IaaS · Linux · macOS
Telemetry
WinEventLog:SysmonWinEventLog:Securityauditd:SYSCALLmacos:unifiedlogAWS:VPCFlowLogsAWS:CloudWatch

How MITRE says to detect it DET0343

Direct Network Flood Detection across IaaS, Linux, Windows, and macOS

Windows Analytic 0969

High-volume packet generation by local processes (e.g., PowerShell, cmd, curl.exe) or network service processes resulting in excessive outbound traffic over short time window, correlated with abnormal resource usage or degraded host responsiveness.

  • WinEventLog:Sysmon EventCode=3, 22
  • WinEventLog:Security EventCode=4688

Linux Analytic 0970

Kernel or userland processes generating high-rate network traffic (ICMP, UDP, TCP SYN) beyond expected interface throughput or user behavior norms.

  • auditd:SYSCALL connect or sendto system call with burst pattern
  • auditd:SYSCALL execve

macOS Analytic 0971

Excessive outbound traffic via `ping`, `curl`, or custom scripts indicating flooding behavior, especially with no UI context or user interaction.

  • macos:unifiedlog process created with repeated ICMP or UDP flood behavior
  • macos:unifiedlog sudden burst in outgoing packets from same PID

IaaS Analytic 0972

VM or cloud instance generating anomalously high network egress targeting same destination IP or service, especially using stateless protocols.

  • AWS:VPCFlowLogs source instance sends large volume of traffic in short window
  • AWS:CloudWatch NetworkOut spike beyond baseline

View on attack.mitre.org ↗

Wazuh Core Ruleset

1 rule
Detection Severity Format
MS-DHCP: Scope Full. High Wazuh XML

elastic/detection-rules

1 rule
Detection Severity Format
Potential DHCP Starvation via High Client MAC Cardinality Medium Elastic TOML

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.