DDoS Attack IP Addresses - Percent Threshold

Status: available
Severity: medium
Time window: 2h
Group by: destPublicIpAddress_s
Source: github.com/Azure/Azure-Sentinel

Identifies IP addresses that generate over 5% of traffic during DDoS attack mitigation

MITRE ATT&CK coverage

Tactic	Techniques
Impact	`T1498` Network Denial of Service

Rules detecting the same action

These rules filter on the same operation.

DDoS Attack IP Addresses - PPS Threshold (Kusto)

Rule body

id: 402a42ad-f31c-48d1-8f80-0200846b7f25
kind: Scheduled
name: DDoS Attack IP Addresses - Percent Threshold
description: Identifies IP addresses that generate over 5% of traffic during DDoS attack mitigation
severity: Medium
status : Available
requiredDataConnectors:
  - connectorId: DDOS
    dataTypes:
      - AzureDiagnostics
queryPeriod: 2h
queryFrequency: 2h
triggerOperator: gt
triggerThreshold: 0
query: |
  let T1 = AzureDiagnostics
    | where ResourceType == "PUBLICIPADDRESSES" and Category == "DDoSMitigationFlowLogs"
    | summarize rows_count = count() by destPublicIpAddress_s, sourcePublicIpAddress_s;
  let T2 = AzureDiagnostics
    | where ResourceType == "PUBLICIPADDRESSES" and Category == "DDoSMitigationFlowLogs"
    | summarize rows_total = count() by destPublicIpAddress_s;
  T2
    | join kind=leftouter T1 on destPublicIpAddress_s
    | project destPublicIpAddress_s, sourcePublicIpAddress_s, percent_of_traffic = 100*rows_count/rows_total
    | order by percent_of_traffic desc
    | where percent_of_traffic > 5
eventGroupingSettings:
  aggregationKind: SingleAlert
entityMappings:
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: sourcePublicIpAddress_s
tactics:
  - Impact
relevantTechniques:
  - T1498
version: 1.0.1

Stages and Predicates

let T2 is inlined into the numbered stages below.

Let binding: `T1` used in Stage 4

let T1 = AzureDiagnostics
  | where ResourceType == "PUBLICIPADDRESSES" and Category == "DDoSMitigationFlowLogs"
  | summarize rows_count = count() by destPublicIpAddress_s, sourcePublicIpAddress_s;

Stages 1 to 3 define let T2 (the rule's main pipeline source); stages 4 to 7 run on it.

Stage 1: `source`

AzureDiagnostics

Stage 2: `where`

| where ResourceType == "PUBLICIPADDRESSES" and Category == "DDoSMitigationFlowLogs"

Stage 3: `summarize`

| summarize rows_total = count() by destPublicIpAddress_s

Stage 4: `join`

T2
| join kind=leftouter T1 on destPublicIpAddress_s

Stage 5: `project`

| project destPublicIpAddress_s, sourcePublicIpAddress_s, percent_of_traffic = 100*rows_count/rows_total

Stage 6: `sort`

| order by percent_of_traffic desc

Stage 7: `where`

| where percent_of_traffic > 5

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Category`	eq	`DDoSMitigationFlowLogs`	`field:"Category" kind:eq value:"DDoSMitigationFlowLogs"`
`ResourceType`	eq	`PUBLICIPADDRESSES`	`field:"ResourceType" kind:eq value:"PUBLICIPADDRESSES"`
`percent_of_traffic`	gt	`5`	`field:"percent_of_traffic" kind:gt value:"5"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`destPublicIpAddress_s`	`project`
`percent_of_traffic`	`project`
`sourcePublicIpAddress_s`	`project`

DDoS Attack IP Addresses - Percent Threshold

MITRE ATT&CK coverage

Rules detecting the same action

Rule body

Stages and Predicates

Let binding: T1 used in Stage 4

Stage 1: source

Stage 2: where

Stage 3: summarize

Stage 4: join

Stage 5: project

Stage 6: sort

Stage 7: where