DDoS Attack IP Addresses - PPS Threshold

Status: available
Severity: medium
Time window: 1s
Group by: destPublicIpAddress_s, sec, sourcePublicIpAddress_s
Source: github.com/Azure/Azure-Sentinel

Identifies IP addresses that generates maximal traffic rate over 10k PPS during DDoS attack mitigation

MITRE ATT&CK coverage

Tactic	Techniques
Impact	`T1498` Network Denial of Service

Rules detecting the same action

These rules filter on the same operation.

DDoS Attack IP Addresses - Percent Threshold (Kusto)

Rule body

id: 6e76fd9d-8104-41eb-bad3-26054a3ad5f0
kind: Scheduled
name: DDoS Attack IP Addresses - PPS Threshold
description: Identifies IP addresses that generates maximal traffic rate over 10k PPS during DDoS attack mitigation
severity: Medium
status : Available
requiredDataConnectors:
  - connectorId: DDOS
    dataTypes:
      - AzureDiagnostics
queryPeriod: 2h
queryFrequency: 2h
triggerOperator: gt
triggerThreshold: 0
query: |
  AzureDiagnostics 
  | where ResourceType == 'PUBLICIPADDRESSES' and Category == "DDoSMitigationFlowLogs"
  //sample rate of mitigation device 1:1000 so the PPS of the source is estimated to be x1000.
  | summarize PPS = 1000 * count() by destPublicIpAddress_s, sec = bin(TimeGenerated, 1s), sourcePublicIpAddress_s
  | summarize maxPPS = max(PPS) by destPublicIpAddress_s, sourcePublicIpAddress_s
  | order by destPublicIpAddress_s, maxPPS desc
  | where maxPPS > 10000
eventGroupingSettings:
  aggregationKind: SingleAlert
entityMappings:
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: sourcePublicIpAddress_s
tactics:
  - Impact
relevantTechniques:
  - T1498
version: 1.0.1

Stages and Predicates

Stage 1: `source`

AzureDiagnostics

Stage 2: `where`

| where ResourceType == 'PUBLICIPADDRESSES' and Category == "DDoSMitigationFlowLogs"

Stage 3: `summarize`

| summarize PPS = 1000 * count() by destPublicIpAddress_s, sec = bin(TimeGenerated, 1s), sourcePublicIpAddress_s

Stage 4: `summarize`

| summarize maxPPS = max(PPS) by destPublicIpAddress_s, sourcePublicIpAddress_s

Stage 5: `sort`

| order by destPublicIpAddress_s, maxPPS desc

Stage 6: `where`

| where maxPPS > 10000

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Category`	eq	`DDoSMitigationFlowLogs`	`field:"Category" kind:eq value:"DDoSMitigationFlowLogs"`
`ResourceType`	eq	`PUBLICIPADDRESSES`	`field:"ResourceType" kind:eq value:"PUBLICIPADDRESSES"`
`maxPPS`	gt	`10000`	`field:"maxPPS" kind:gt value:"10000"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`destPublicIpAddress_s`	`summarize`
`maxPPS`	`summarize`
`sourcePublicIpAddress_s`	`summarize`

DDoS Attack IP Addresses - PPS Threshold

MITRE ATT&CK coverage

Rules detecting the same action

Rule body

Stages and Predicates

Stage 1: source

Stage 2: where

Stage 3: summarize

Stage 4: summarize

Stage 5: sort

Stage 6: where