tfMITRE ATT&CK sub-technique

Direct Network Flood T1498.001

sub-technique of T1498 Network Denial of Service

Tactic: Impact
Platforms: Windows, IaaS, Linux, macOS
Version: 1.4
Created: 02 March 2020
Last modified: 24 October 2025

Adversaries may attempt to cause a denial of service (DoS) by directly sending a high-volume of network traffic to a target. This DoS attack may also reduce the availability and functionality of the targeted system(s) and network. Direct Network Floods are when one or more systems are used to send a high-volume of network packets towards the targeted service's network. Almost any network protocol may be used for flooding. Stateless protocols such as UDP or ICMP are commonly used but stateful protocols such as TCP can be used as well.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsNone recorded

Threat groupsNone recorded · 29% of ATT&CK techniques have none either.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malwareNone recorded

Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.

Detection rulesNone recorded

Detection rulesNone recorded · 33% of ATT&CK techniques have none either.

Offense vs defense T1498.001

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

Direct Network Flood detection strategy DET0343

MITRE names one behaviour worth catching for this technique and breaks it into 4 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Direct Network Flood Detection across IaaS, Linux, Windows, and macOS

Enterprise

4 platforms

AN0969 · Windows

High-volume packet generation by local processes (e.g., PowerShell, cmd, curl.exe) or network service processes resulting in excessive outbound traffic over short time window, correlated with abnormal resource usage or degraded host responsiveness.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Security	EventCode=4688
Network Connection CreationDC0082	WinEventLog:Sysmon	EventCode=3, 22

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
PacketRateThreshold	Defines the burst threshold (e.g., 10,000 pps) above which activity should be flagged as anomalous.
TimeWindow	Duration over which to aggregate and analyze flow volume.

AN0970 · Linux

Kernel or userland processes generating high-rate network traffic (ICMP, UDP, TCP SYN) beyond expected interface throughput or user behavior norms.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	auditd:SYSCALL	execve
Network Traffic FlowDC0078	auditd:SYSCALL	connect or sendto system call with burst pattern

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
SyscallBurstCount	Threshold of repeated socket calls within a short interval indicating flood behavior.
UserContext	Restrict to non-admin user traffic unless elevated access is detected.

AN0971 · macOS

Excessive outbound traffic via ping, curl, or custom scripts indicating flooding behavior, especially with no UI context or user interaction.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	macos:unifiedlog	process created with repeated ICMP or UDP flood behavior
Network Traffic FlowDC0078	macos:unifiedlog	sudden burst in outgoing packets from same PID

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
BurstTimeWindow	Tunable range (e.g., 15s, 30s) for detecting packet floods.

AN0972 · IaaS

VM or cloud instance generating anomalously high network egress targeting same destination IP or service, especially using stateless protocols.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Host StatusDC0018	AWS:CloudWatch	NetworkOut spike beyond baseline
Network Traffic FlowDC0078	AWS:VPCFlowLogs	source instance sends large volume of traffic in short window

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
InstanceTrafficThreshold	Alert when egress exceeds normal usage by X%.
ProtocolType	Prioritize alerts on stateless protocols such as UDP and ICMP.

Direct Network Flood detections T1498.001

No detection rules are mapped to this technique yet.

None recorded— 33% of ATT&CK techniques have none either

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs