APT28G0007 ↗
In 2016, APT28 conducted a distributed denial of service (DDoS) attack against the World Anti-Doping Agency.1
tfMITRE ATT&CK technique
Network Denial of Service T1498
- Tactic
- Impact
- Platforms
- Windows, IaaS, Linux, macOS, Containers
- Version
- 1.2
- Created
- 17 April 2019
- Last modified
- 24 October 2025
- Contributors
- Yossi Weizman, Azure Defender Research Team; Vishwas Manral, McAfee
Sub-techniques 210 rules across the family · 9 mapped directly to T1498 · 1 of 2 carry rules
Adversaries may perform Network Denial of Service (DoS) attacks to degrade or block the availability of targeted resources to users. Network DoS can be performed by exhausting the network bandwidth services rely on. Example resources include specific websites, email services, DNS, and web-based applications. Adversaries have been observed conducting network DoS attacks for political purposes[1] and to support other malicious activities, including distraction[2], hacktivism, and extortion.[3]
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
1
Threat groups45th pct
Threat groups45th percentile · 55% of ATT&CK techniques have more threat groups attributed.0
CampaignsNone recorded
CampaignsNone recorded · 54% of ATT&CK techniques have none either.2
Tools & malware51st pct
Tools & malware51st percentile · 51% of ATT&CK techniques have this many tools implementing them or fewer.9
Detection rules73rd pct
Detection rules73rd percentile · 73% of ATT&CK techniques have this many detection rules written or fewer.Network Denial of Service MITRE reference T1498
45th pctamong all ATT&CK techniques for number of groups
1 group has been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
All 1 groups for this technique
2 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
NKAbuseS1107 ↗
Enables multiple types of network denial of service capabilities across several protocols post-installation.1
LuciferS0532 ↗
Can execute TCP, UDP, and HTTP denial of service (DoS) attacks.1
All 2 software entries for this technique
Offense vs defense T1498
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 0Sigma rules (cumulative) · 3Splunk ESCU (cumulative) · 6
first rule: 2020 Q3Network Denial of Service detection strategy DET0518
MITRE names one behaviour worth catching for this technique and breaks it into 2 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Behavioral Detection of T1498 – Network Denial of Service Across Platforms
2 platforms
AN1434 · Windows
Executable or script generating large outbound network traffic targeting remote hosts or known amplification ports
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | WinEventLog:Sysmon | EventCode=1 |
| Network Connection CreationDC0082 | WinEventLog:Sysmon | EventCode=3, 22 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| ThresholdEventVolume | Number of connections per second that should trigger anomaly logic |
| DestinationDiversity | Count of unique destination IPs or ports |
AN1435 · Linux
Flooding tools like hping3 or nping sending large volumes of packets across multiple ports or IPs
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | auditd:SYSCALL | Execution of network stress tools or anomalies in socket/syscall behavior |
| Network Traffic FlowDC0078 | NSM:Flow | High volume flows with incomplete TCP sessions or single-packet bursts |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| PacketRateThreshold | Packets per second beyond normal behavior |
When flood volumes exceed the capacity of the network connection being targeted, it is typically necessary to intercept the incoming traffic upstream to filter out the attack traffic from the legitimate traffic. Such defenses can be provided by the hosting Internet Service Provider (ISP) or by a 3rd party such as a Content Delivery Network (CDN) or providers specializing in DoS mitigations. Depending on flood volume, on-premises filtering may be possible by blocking source addresses sourcing the attack, blocking ports that are being targeted, or blocking protocols being used for transport. As immediate response may require rapid engagement of 3rd parties, analyze the risk associated to critical resources being affected by Network DoS attacks and create a disaster recovery plan/business continuity plan to respond to incidents.