Network Denial of Service: Direct Network Flood T1498.001

Tactic: Impact

Adversaries may attempt to cause a denial of service (DoS) by directly sending a high-volume of network traffic to a target. This DoS attack may also reduce the availability and functionality of the targeted system(s) and network. Direct Network Floods are when one or more systems are used to send a high-volume of network packets towards the targeted service's network. Almost any network protocol may be used for flooding. Stateless protocols such as UDP or ICMP are commonly used but stateful protocols such as TCP can be used as well.

Authoring guide

These 1 rule share fields, values, and exclusions.

Fields filtered most (5 distinct)

These fields appear most often in rule filters.

FieldRulesHowSample values
Esql.client_mac1is_not_null 1
Esql.dhcpv4_client_mac_count_distinct1ge 150
Esql.dhcpv4_discover_count1ge 175
Esql.message_type1eq 1discover
Esql.observer_hostname1is_not_null 1

Top indicator values (3 distinct)

These values appear most often in rule predicates.

FieldKindValueRules (here)Corpus reach
Esql.dhcpv4_client_mac_count_distinctge
50
1
Esql.dhcpv4_discover_countge
75
1
Esql.message_typeeq
discover
1

Rules under this technique

These vendors publish rules tagged with this technique.

Platform: Network

Domain: Network

Elastic 1 rule