tfMITRE ATT&CK technique

Network Denial of Service T1498

Tactic: Impact
Platforms: Windows, IaaS, Linux, macOS, Containers
Version: 1.2
Created: 17 April 2019
Last modified: 24 October 2025
Contributors: Yossi Weizman, Azure Defender Research Team; Vishwas Manral, McAfee

Sub-techniques 210 rules across the family · 9 mapped directly to T1498 · 1 of 2 carry rules

.001Direct Network Flood0 .002Reflection Amplification1

Adversaries may perform Network Denial of Service (DoS) attacks to degrade or block the availability of targeted resources to users. Network DoS can be performed by exhausting the network bandwidth services rely on. Example resources include specific websites, email services, DNS, and web-based applications. Adversaries have been observed conducting network DoS attacks for political purposes[1] and to support other malicious activities, including distraction[2], hacktivism, and extortion.[3]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups45th pct

Threat groups45th percentile · 55% of ATT&CK techniques have more threat groups attributed.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware51st pct

Tools & malware51st percentile · 44% of ATT&CK techniques have fewer tools implementing them.

Detection rules73rd pct

Detection rules73rd percentile · 71% of ATT&CK techniques have fewer detection rules written.

Offense vs defense T1498

Compare defenses against adversary use. Eight counts, ranking this technique against the entire ATT&CK Enterprise matrix. Attack sits left, defense right.

Range

Technique Campaign use over its cumulative rule count.

Campaigns · 0Sigma rules (cumulative) · 3Splunk ESCU (cumulative) · 6

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
Network Connection CreationDC0082	WinEventLog:Sysmon	EventCode=3, 22

Data component

Name

Channel

Process CreationDC0032

WinEventLog:Sysmon

EventCode=1

Network Connection CreationDC0082

WinEventLog:Sysmon

EventCode=3, 22

Field	What you tune
ThresholdEventVolume	Number of connections per second that should trigger anomaly logic
DestinationDiversity	Count of unique destination IPs or ports

Field

What you tune

ThresholdEventVolume

Number of connections per second that should trigger anomaly logic

DestinationDiversity

Count of unique destination IPs or ports

Data component	Name	Channel
Process CreationDC0032	auditd:SYSCALL	Execution of network stress tools or anomalies in socket/syscall behavior
Network Traffic FlowDC0078	NSM:Flow	High volume flows with incomplete TCP sessions or single-packet bursts

Field	What you tune
PacketRateThreshold	Packets per second beyond normal behavior

Offense vs defense T1498

Compare defenses against adversary use. Eight counts, ranking this technique against the entire ATT&CK Enterprise matrix. Attack sits left, defense right.

Range

Technique Campaign use over its cumulative rule count.

Campaigns · 0Sigma rules (cumulative) · 3Splunk ESCU (cumulative) · 6

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
Network Connection CreationDC0082	WinEventLog:Sysmon	EventCode=3, 22

Data component

Name

Channel

Process CreationDC0032

WinEventLog:Sysmon

EventCode=1

Network Connection CreationDC0082

WinEventLog:Sysmon

EventCode=3, 22

Field	What you tune
ThresholdEventVolume	Number of connections per second that should trigger anomaly logic
DestinationDiversity	Count of unique destination IPs or ports

Field

What you tune

ThresholdEventVolume

Number of connections per second that should trigger anomaly logic

DestinationDiversity

Count of unique destination IPs or ports

Data component	Name	Channel
Process CreationDC0032	auditd:SYSCALL	Execution of network stress tools or anomalies in socket/syscall behavior
Network Traffic FlowDC0078	NSM:Flow	High volume flows with incomplete TCP sessions or single-packet bursts

Field	What you tune
PacketRateThreshold	Packets per second beyond normal behavior

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
	Detects the removal of a deployment from a Kubernetes cluster. (...)	Generic	test	-	-	Kubernetes Audit · Kubernetes	Impact Network Denial of Service	-	low	Leo Tsaousis (@laripping)	2024-03-26	—	40967487-139b-4811-81d9-c9767a92aa5a
Splunk	The following analytic detects ARP Poisoning attacks by monitoring for Dynamic ARP Inspection (DAI) errors on Cisco network devices. (...)	Generic	experimental	network_device	-	Cisco IOS · Cisco	Credential Access, Collection Adversary-in-the-Middle ARP Cache Poisoning Initial Access Hardware Additions Impact Network Denial of Service	-	medium	Mikael Bjerkeland, Splunk	2020-08-11	2026-05-13	b44bebd6-bd39-467b-9321-73971bcd1aac	-
Splunk	The following analytic detects IPv6 network infrastructure threats by identifying suspicious activities such as IP and MAC address theft or packet drops. (...)	Generic	experimental	network_device	-	Cisco IOS · Cisco	Credential Access, Collection Adversary-in-the-Middle ARP Cache Poisoning Initial Access Hardware Additions Impact Network Denial of Service	-	medium	Mikael Bjerkeland, Splunk	2020-10-28	2026-05-13	c3be767e-7959-44c5-8976-0e9c12a91ad2
Splunk	The following analytic detects port security violations on Cisco switches. (...)	Generic	experimental	network_device	-	Cisco IOS · Cisco	Credential Access, Collection Adversary-in-the-Middle ARP Cache Poisoning Initial Access Hardware Additions Impact Network Denial of Service	-	medium	Mikael Bjerkeland, Splunk	2020-10-28	2026-05-13	2de3d5b8-a4fa-45c5-8540-6d071c194d24	-
Splunk	The following analytic identifies the presence of unauthorized DHCP servers on the network. (...)	Generic	experimental	network_device	-	Cisco IOS · Cisco	Credential Access, Collection Adversary-in-the-Middle Initial Access Hardware Additions Impact Network Denial of Service	-	medium	Mikael Bjerkeland, Splunk	2020-08-11	2026-05-13	6e1ada88-7a0d-4ac1-92c6-03d354686079	-
Splunk	The following analytic detects the initiation of traffic mirroring sessions on Cisco network devices. (...)	Generic	experimental	network_device	-	Cisco IOS · Cisco	Exfiltration Automated Exfiltration Traffic Duplication Initial Access Hardware Additions Impact Network Denial of Service	-	medium	Mikael Bjerkeland, Splunk	2020-10-28	2026-05-13	42b3b753-5925-49c5-9742-36fa40a73990	-
Splunk	Detects high Ollama API request volumes from a single client in a short time window. (...)	Anomaly	stable	-	-	Ollama	Impact Network Denial of Service	-	medium	Rod Soto, Nasreddine Bencherchali, Splunk	2025-10-13	2026-10-09	1cfab663-9adc-4169-a88c-6bae29ba3c70
	Detects instances where an NTP service on an OpenCanary node has had a NTP monlist request.	Generic	test	-	-	OpenCanary	Impact Network Denial of Service	-	high	Security Onion Solutions	2024-03-08	—	7cded4b3-f09e-405a-b96f-24248433ba44
	Detects command line patterns used by BlackByte ransomware in different operations	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Impact Data Destruction Stealth Deobfuscate/Decode Files or Information Impact Network Denial of Service	-	high	Florian Roth (Nextron Systems)	2022-02-25	2023-02-08	999e8307-a775-4d5f-addc-4855632335be

Title

Description

Network Denial of Service T1498

Network Denial of Service T1498

Network Denial of Service MITRE reference T1498

Offense vs defense T1498

Network Denial of Service detection strategy DET0518

Behavioral Detection of T1498 – Network Denial of Service Across Platforms

Log sources

Tunable fields

Log sources

Tunable fields

Network Denial of Service MITRE reference T1498

Offense vs defense T1498

Network Denial of Service detection strategy DET0518

Behavioral Detection of T1498 – Network Denial of Service Across Platforms

Log sources

Tunable fields

Log sources

Tunable fields

Network Denial of Service detections T1498

Network Denial of Service detections T1498