T1498.001sub-technique of T1498 Network Denial of Service
Direct Network Flood
Windows · IaaS · Linux · macOSnothing on this site yetT1498.001 on attack.mitre.org
Adversaries may attempt to cause a denial of service (DoS) by directly sending a high-volume of network traffic to a target. This DoS attack may also reduce the availability and functionality of the targeted system(s) and network. Direct Network Floods are when one or more systems are used to send a high-volume of network packets towards the targeted service's network. Almost any network protocol may be used for flooding.
If this is happening now
Checklists and playbooks to open while the alert is still live.
Playbook for this stage
Ransomware, suspected or confirmed
Files renamed or unreadable, a ransom note, or backup deletion commands seen.
how MITRE says to see it
Direct Network Flood Detection across IaaS, Linux, Windows, and macOS
- High-volume packet generation by local processes (e.g., PowerShell, cmd, curl.exe) or network service processes resulting in excessive outbound traffic over short time window, correlated with abnormal resource usage or degraded host responsiveness.
- Kernel or userland processes generating high-rate network traffic (ICMP, UDP, TCP SYN) beyond expected interface throughput or user behavior norms.
- Excessive outbound traffic via `ping`, `curl`, or custom scripts indicating flooding behavior, especially with no UI context or user interaction.
- VM or cloud instance generating anomalously high network egress targeting same destination IP or service, especially using stateless protocols.
what reduces it
- M1037 Filter Network Traffic. When flood volumes exceed the capacity of the network connection being targeted, it is typically necessary to intercept the incoming traffic upstream to filter out the attack traffic from the legitimate traffic. Such defenses can be provided by the hosting Internet Service Provider (ISP) or by a 3rd party such as a Content Delivery Network (CDN) or providers specializing in DoS mitigations.