T1498.002 — Reflection Amplification

Tactic: Impact · Platforms: Windows, IaaS, Linux, macOS

Adversaries may attempt to cause a denial of service (DoS) by reflecting a high-volume of network traffic to a target. This type of Network DoS takes advantage of a third-party server intermediary that hosts and will respond to a given spoofed source IP address. This third-party server is commonly…

Sub-technique of Network Denial of Service (T1498).

Sigma detection rules (4)

title: "T1498.002 Network Denial of Service: Reflection Amplification"
id: b5e729d9-91ad-4bea-87d9-755d702c43dd
description: 'Detects a host establishing outbound UDP connections to protocols commonly abused as reflection/amplification vectors (DNS 53, NTP 123, SSDP 1900, memcached 11211, chargen 19, SNMP 161); single Sysmon connection events cannot confirm spoofed source addresses or amplification ratio, so this is a precursor proxy best paired with a connection-volume/distinct-destination correlation rule for high-confidence detection. (Data Component: Network Connection Creation; baseline tier: windows-eventid.) Tune using: TimeWindow, AmplificationProtocolPorts, PacketToByteRatio.'
references:
  - https://attack.mitre.org/techniques/T1498/002
author: Shahrukh Khan
date: 2026-05-15
license: MIT
tags:
  - attack.impact
  - attack.t1498.002

logsource:
  category: network_connection
  product: windows
  service: sysmon

detection:
  selection:
    EventID: '3'
    Protocol: 'udp'
    DestinationPort:
      - 53
      - 123
      - 1900
      - 11211
      - 19
      - 161

  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection and not filter_system_account

falsepositives:
  - System and service accounts (SYSTEM, LOCAL SERVICE, NETWORK SERVICE) performing the same action are excluded via filter_system_account; tune further with process/path allowlists if noise remains.
  - Legitimate DNS/NTP/SSDP client traffic; requires volume-based correlation to isolate actual abuse.

level: medium

title: "T1498.002 Network Denial of Service: Reflection Amplification"
id: c7f8a1a3-870a-4d69-97a7-11a7887a0c38
description: 'Detection Strategy for Reflection Amplification DoS (T1498.002), with mdk3 removed (an 802.11 wireless deauthentication/injection tool unrelated to this technique) and now requiring both a spoofed-source-IP flag and a known amplification-protocol port (DNS/53, NTP/123, memcached/11211) in the same invocation, rather than flagging any invocation of hping3/nping regardless of arguments. Tune using: TimeWindow, AmplificationProtocolList, ExecutionToolList.'
references:
  - https://attack.mitre.org/techniques/T1498/002
author: Shahrukh Khan
date: 2026-06-15
license: MIT
tags:
  - attack.impact
  - attack.t1498.002

logsource:
  category: process_creation
  product: linux

detection:
  selection_tool:
    type: EXECVE
    a0|endswith:
      - '/hping3'
      - '/nping'
  selection_spoof:
    a1|contains:
      - '-a'
      - '--spoof'
      - '-S'
      - '--source-ip'
  selection_amp_port:
    a1|contains:
      - '53'
      - '123'
      - '11211'

  condition: selection_tool and selection_spoof and selection_amp_port

falsepositives:
  - Authorized security-testing tools run by internal red teams against approved amplification-protocol targets; ExecutionToolList/AmplificationProtocolList still require confirming the target is a real third-party reflector rather than an internal test asset.

level: high

title: "T1498.002 Network Denial of Service: Reflection Amplification"
id: 74fa6052-17ff-4dc7-8b08-5304e7746aa4
description: 'Detection Strategy for Reflection Amplification DoS (T1498.002). (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ReflectionPorts, TrafficSpikeThreshold.'
references:
  - https://attack.mitre.org/techniques/T1498/002
author: Shahrukh Khan
date: 2026-02-26
license: MIT
tags:
  - attack.impact
  - attack.t1498.002

logsource:
  product: macos

detection:
  selection:
    Image|endswith:
      - '/nc'
      - '/python3'
  selection_port:
    DestinationPort:
      - 53
      - 123
      - 1900
  condition: selection and selection_port

falsepositives:
  - Reflection amplification abuse of DNS, NTP, or SSDP is indistinguishable at the process level from a legitimate diagnostic query to the same ports, so a sustained high request rate rather than a single connection is the real indicator and that rate is not captured by this event category alone.

level: high

title: "T1498.002 Network Denial of Service: Reflection Amplification"
id: 553a179a-adba-4a28-949e-2e8655b6be80
description: 'Detection Strategy for Reflection Amplification DoS (T1498.002). (Retargeted to the cloudtrail AWS telemetry that actually captures this techniques behavior; see logsource below.) Tune using: EgressRulePorts, OutboundToInboundRatio, VMInstanceTagContext.'
references:
  - https://attack.mitre.org/techniques/T1498/002
author: Shahrukh Khan
date: 2026-05-30
license: MIT
tags:
  - attack.impact
  - attack.t1498.002

logsource:
  category: cloudtrail
  product: aws

detection:
  selection:
    eventSource: 'ec2.amazonaws.com'
    eventName: 'AuthorizeSecurityGroupEgress'
    requestParameters.ipPermissions.items.ipProtocol: 'udp'
    requestParameters.ipPermissions.items.fromPort:
      - 53
      - 123
      - 1900

  condition: selection

falsepositives:
  - Legitimate NTP or DNS server security groups will need these same egress ports open, so verify the security group is attached to a known reflector-capable public-facing instance before escalating.

level: high

Related sub-techniques

• T1498.001 Direct Network Flood

Explore

• All Sigma rules for MITRE ATT&CK
• Sigma rule format guide
• Full T1498.002 intelligence — ATT&CK Intelligence View
• Official MITRE ATT&CK entry
• Built by Shahrukh Khan