T1498.001, Direct Network Flood, is a denial of service where one or more systems send a high volume of network traffic straight at a target. It applies to Windows, IaaS, Linux and macOS and falls under impact.
How attackers use it
The flood reduces the availability and function of the targeted systems and network. Almost any network protocol can be used. Stateless protocols such as UDP or ICMP are commonly used, though stateful protocols like TCP can be too.
Botnets are common. Adversaries may build their own or rent time on an existing one. In the largest cases, so many systems take part that each needs to send only a small amount of traffic to saturate the target, and telling the flood from legitimate clients becomes very hard. MITRE cites the 2012 series of attacks on major US banks as a high profile botnet driven example.
How to detect it
MITRE's detection strategy looks for unusually high outbound traffic from hosts, often alongside strain on the host.
- Windows and general: local processes such as PowerShell, cmd or curl.exe, or network service processes, sending a large volume of packets in a short window, possibly with high resource use or a host that responds slowly.
- Linux: kernel or user level processes that generate high rate ICMP, UDP or TCP SYN traffic above normal interface throughput.
- macOS: tools such as ping, curl or custom scripts sending excessive outbound traffic without user interaction.
- Cloud: a VM or instance with abnormally high egress aimed at one destination IP or service, particularly with stateless protocols.
MITRE names no log sources. Process activity, network flow data and resource usage data are implied. For the victim side, watch inbound traffic and link saturation.
How to reduce the risk
MITRE lists filtering network traffic. When flood volume exceeds the capacity of the connection, intercept traffic upstream, through the ISP, a CDN or a mitigation provider. Prepare this before you need it, and keep your own hosts from becoming part of a flood by restricting what they can send.
Quick check
Which protocols are commonly used for direct floods?
Stateless protocols such as UDP and ICMP, though TCP can also be used.
