T1498.001 — Direct Network Flood

Tactic: Impact · Platforms: Windows, IaaS, Linux, macOS

Adversaries may attempt to cause a denial of service (DoS) by directly sending a high-volume of network traffic to a target. This DoS attack may also reduce the availability and functionality of the targeted system(s) and network. Direct Network Floods are when one or more systems are used to send…

Sub-technique of Network Denial of Service (T1498).

Sigma detection rules (4)

title: "T1498.001 Network Denial of Service: Direct Network Flood"
id: fabed80e-be35-4ba8-a22f-84545d09a7b5
description: 'Direct Network Flood Detection across IaaS, Linux, Windows, and macOS. (Retargeted from the original process_creation label to network_connection — this is the telemetry source that actually captures this technique''s behavior; see logsource below.) Tune using: PacketRateThreshold, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1498/001
author: Shahrukh Khan
date: 2026-04-23
license: MIT
tags:
  - attack.impact
  - attack.t1498.001

logsource:
  category: network_connection
  product: windows
  service: sysmon

detection:
  selection:
    Image|endswith:
      - '\hping3.exe'
      - '\loic.exe'

  condition: selection

falsepositives:
  - Effectively none for these specific tool names in an enterprise Windows environment; volumetric-flood detection is better handled at the network layer (NetFlow/IDS) than via a single-host Sigma rule.

level: critical

title: "T1498.001 Network Denial of Service: Direct Network Flood"
id: b2d03117-c1a1-4b2b-b811-8c56d961af49
description: 'Direct Network Flood Detection across IaaS, Linux, Windows, and macOS. (Retargeted to the network_connection auditd telemetry that actually captures this techniques behavior; see logsource below.) A single hping sendto() call only identifies use of a flood-capable tool, not actual high-volume flooding; this base rule now serves as a precursor signal feeding the companion correlation rule below (SyscallBurstCount), which counts sendto calls from the same process within a 1-minute window and only escalates to a flood verdict once a volume threshold is crossed. Tune using: SyscallBurstCount, UserContext.'
references:
  - https://attack.mitre.org/techniques/T1498/001
author: Shahrukh Khan
date: 2026-06-18
license: MIT
tags:
  - attack.impact
  - attack.t1498.001

logsource:
  category: network_connection
  product: linux

detection:
  selection:
    type: SYSCALL
    syscall: sendto
    exe|contains: '/hping'

  condition: selection

falsepositives:
  - This single-event rule only flags use of a flood-capable tool; treat it as informational unless the companion correlation rule (SyscallBurstCount threshold) also fires, since one-off diagnostic use of hping (e.g. path MTU testing) will match this base selection without producing a real flood volume.

level: low

---
title: T1498.001 Network Denial of Service - Direct Network Flood Sendto Burst
id: 7f3a9c1e-6b52-4a8d-9e21-3c5f7a2b9d40
description: 'Correlation companion for b2d03117-c1a1-4b2b-b811-8c56d961af49: counts hping sendto() syscalls from the same process within a 1-minute window, approximating the high-volume flood behavior that a single sendto event cannot establish on its own.'
status: experimental
correlation:
  type: event_count
  rules:
    - b2d03117-c1a1-4b2b-b811-8c56d961af49
  group-by:
    - exe
  timespan: 1m
  condition:
    gte: 100
level: high

title: "T1498.001 Network Denial of Service: Direct Network Flood"
id: ead8b3e6-830b-41c7-9d42-636a002d873b
description: 'Direct Network Flood Detection across IaaS, Linux, Windows, and macOS. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: BurstTimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1498/001
author: Shahrukh Khan
date: 2026-01-14
license: MIT
tags:
  - attack.impact
  - attack.t1498.001

logsource:
  product: macos

detection:
  selection:
    Image|endswith:
      - '/hping3'
      - '/nc'
      - '/python3'
  selection_args:
    CommandLine|contains:
      - '--flood'
      - 'SYN_FLOOD'
  condition: selection and selection_args

falsepositives:
  - Legitimate network stress-testing tools used by administrators during capacity planning generate an identical process signature, so this should be limited to hosts that are not designated load-testing systems.

level: high

title: "T1498.001 Network Denial of Service: Direct Network Flood"
id: 8bfc027f-6318-4592-b93e-b5ef2b072976
description: 'Direct Network Flood Detection across IaaS, Linux, Windows, and macOS. (Retargeted to the network_connection AWS telemetry that actually captures this techniques behavior; see logsource below.) Tune using: InstanceTrafficThreshold, ProtocolType.'
references:
  - https://attack.mitre.org/techniques/T1498/001
author: Shahrukh Khan
date: 2026-04-07
license: MIT
tags:
  - attack.impact
  - attack.t1498.001

logsource:
  category: network_connection
  product: aws
  service: vpcflowlogs

detection:
  selection:
    action: 'accept'
    dst_port:
      - 80
      - 443
      - 53
  selection_protocol:
    protocol:
      - 'udp'
      - 'tcp'

  condition: selection and selection_protocol

falsepositives:
  - VPC Flow Logs record connection metadata but not payload volume trends without additional aggregation, so distinguishing a legitimate traffic spike from a direct flood requires downstream volumetric analysis, which lowers standalone confidence.

level: medium

Related sub-techniques

• T1498.002 Reflection Amplification

Explore

• All Sigma rules for MITRE ATT&CK
• Sigma rule format guide
• Full T1498.001 intelligence — ATT&CK Intelligence View
• Official MITRE ATT&CK entry
• Built by Shahrukh Khan