T1498
Network Denial of Service
Windows · IaaS · Linux · macOS · Containers1 piece on this siteT1498 on attack.mitre.org
Adversaries may perform Network Denial of Service (DoS) attacks to degrade or block the availability of targeted resources to users. Network DoS can be performed by exhausting the network bandwidth services rely on. Example resources include specific websites, email services, DNS, and web-based applications.
If this is happening now
Checklists and playbooks to open while the alert is still live.
First-hour playbookMembers
A service is being denied
A public service is unreachable or degraded, and the traffic is not yours.
T1498
how MITRE says to see it
Behavioral Detection of T1498 – Network Denial of Service Across Platforms
- Executable or script generating large outbound network traffic targeting remote hosts or known amplification ports
- Flooding tools like hping3 or nping sending large volumes of packets across multiple ports or IPs
what reduces it
- M1037 Filter Network Traffic. When flood volumes exceed the capacity of the network connection being targeted, it is typically necessary to intercept the incoming traffic upstream to filter out the attack traffic from the legitimate traffic. Such defenses can be provided by the hosting Internet Service Provider (ISP) or by a 3rd party such as a Content Delivery Network (CDN) or providers specializing in DoS mitigations.