Network Denial of Service

let KnownDosTools = dynamic([
  "hping3", "hping", "nping", "loic", "hoic", "slowloris", "goldeneye",
  "mausezahn", "t50", "trinoo", "tfn", "tfn2k", "stacheldraht", "trin00",
  "udpflood", "synflood", "icmpflood", "rudy", "pyloris", "xerxes",
  "hulk", "thc-ssl-dos", "siege", "ab.exe", "wrk", "vegeta"
]);
let DosToolPatterns = dynamic([
  "--flood", "--faster", "-flood", "--ddos", "-ddos",
  "sendudp", "sendtcp", "synflood", "udpflood", "icmpflood",
  "--interval 0", "-i 0", "--count 999999", "-c 999999",
  "nmap --script dos", "metasploit auxiliary/dos"
]);
let HighVolumeConnThreshold = 500;
let LookbackWindow = 1h;
// Detection 1: Known DoS tool execution
let DosToolExec = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName has_any (KnownDosTools)
    or ProcessCommandLine has_any (DosToolPatterns)
    or ProcessCommandLine has_any (KnownDosTools)
| extend DetectionSource = "KnownDoSTool"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
         InitiatingProcessFileName, InitiatingProcessCommandLine, DetectionSource;
// Detection 2: Anomalous outbound connection volume per process
let HighVolumeOutbound = DeviceNetworkEvents
| where Timestamp > ago(24h)
| where ActionType == "ConnectionSuccess" or ActionType == "ConnectionAttempt"
| where RemoteIPType == "Public"
| summarize
    ConnectionCount = count(),
    UniqueRemoteIPs = dcount(RemoteIP),
    UniqueRemotePorts = dcount(RemotePort),
    Protocols = make_set(Protocol),
    FirstSeen = min(Timestamp),
    LastSeen = max(Timestamp)
    by DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, bin(Timestamp, LookbackWindow)
| where ConnectionCount > HighVolumeConnThreshold
    or UniqueRemoteIPs > 50
| extend DetectionSource = "HighVolumeOutboundConnections"
| project FirstSeen, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine,
         ConnectionCount, UniqueRemoteIPs, UniqueRemotePorts, Protocols, DetectionSource;
// Detection 3: Rapid repeated connection attempts to single target (SYN flood indicator)
let SynFloodIndicator = DeviceNetworkEvents
| where Timestamp > ago(24h)
| where ActionType == "ConnectionAttempt"
| where RemoteIPType == "Public"
| summarize
    AttemptCount = count(),
    UniqueLocalPorts = dcount(LocalPort),
    FirstAttempt = min(Timestamp),
    LastAttempt = max(Timestamp)
    by DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, bin(Timestamp, 5m)
| where AttemptCount > 200
| extend AttemptsPerSecond = AttemptCount / 300.0
| extend DetectionSource = "RapidConnectionAttempts"
| project FirstAttempt, DeviceName, RemoteIP, RemotePort, AttemptCount,
         AttemptsPerSecond, InitiatingProcessFileName, DetectionSource;
// Union all detection sources
DosToolExec
| union kind=outer (
    HighVolumeOutbound | extend RemoteIP = "", RemotePort = 0
)
| union kind=outer (
    SynFloodIndicator | extend AccountName = "", ProcessCommandLine = InitiatingProcessFileName
)
| sort by Timestamp desc

| multisearch
  [
    search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
    | eval detection_type="dos_tool_exec"
    | eval Image=lower(Image), CommandLine=lower(CommandLine)
    | where match(Image, "(hping|loic|hoic|slowloris|goldeneye|mausezahn|t50|trinoo|tfn2k|stacheldraht|udpflood|synflood|hulk|xerxes|siege|wrk)")
       OR match(CommandLine, "(--flood|--ddos|-ddos|synflood|udpflood|icmpflood|sendudp|sendtcp|--interval\s+0|-i\s+0|-c\s+999)")
    | eval host=host, process=Image, cmdline=CommandLine, user=User
    | table _time, host, user, process, cmdline, detection_type
  ]
  [
    search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=3
    NOT (DestinationIp="10.*" OR DestinationIp="172.16.*" OR DestinationIp="172.17.*"
         OR DestinationIp="172.18.*" OR DestinationIp="172.31.*"
         OR DestinationIp="192.168.*" OR DestinationIp="127.*" OR DestinationIp="::1")
    | eval detection_type="high_volume_outbound"
    | stats
        count as conn_count,
        dc(DestinationIp) as unique_remote_ips,
        dc(DestinationPort) as unique_remote_ports,
        values(DestinationPort) as ports_seen,
        earliest(_time) as first_seen,
        latest(_time) as last_seen
        by host, Image, span(_time, 1h)
    | where conn_count > 500 OR unique_remote_ips > 50
    | eval cmdline="N/A", user="N/A", process=Image
    | eval summary=conn_count." connections to ".unique_remote_ips." unique IPs over 1h"
    | table first_seen, host, user, process, cmdline, detection_type, conn_count, unique_remote_ips, summary
  ]
  [
    search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=3
    NOT (DestinationIp="10.*" OR DestinationIp="172.16.*" OR DestinationIp="192.168.*" OR DestinationIp="127.*")
    | eval detection_type="rapid_connection_attempts"
    | bin _time span=5m
    | stats
        count as attempt_count,
        dc(SourcePort) as unique_src_ports,
        values(Image) as initiating_process
        by host, DestinationIp, DestinationPort, _time
    | where attempt_count > 200
    | eval rate_per_sec=round(attempt_count/300, 2)
    | eval cmdline="Target: ".DestinationIp.":".DestinationPort, user="N/A"
    | eval process=mvindex(initiating_process, 0)
    | table _time, host, user, process, cmdline, detection_type, attempt_count, rate_per_sec, DestinationIp, DestinationPort
  ]
| eval severity=case(
    detection_type=="dos_tool_exec", "critical",
    detection_type=="high_volume_outbound" AND conn_count > 2000, "high",
    detection_type=="rapid_connection_attempts" AND attempt_count > 500, "high",
    true(), "medium"
  )
| sort - _time

process where event.type == "start" and
  (process.name : ("hping3","hping","loic","hoic","slowloris","goldeneye","mausezahn",
                    "t50","trinoo","tfn2k","stacheldraht","siege","wrk") or
   process.command_line : ("*--flood*","*--ddos*","*-ddos*","*synflood*","*udpflood*",
                            "*--interval 0*","-i 0","*-c 999999*"))

SELECT DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') as EventTime,
  logsourcename(logsourceid) as LogSource, username as User,
  "Image" as ProcessImage, "CommandLine" as CommandLine,
  CASE WHEN LOWER("Image") LIKE '%hping%' OR LOWER("Image") LIKE '%loic%'
            OR LOWER("Image") LIKE '%hoic%' OR LOWER("Image") LIKE '%slowloris%' THEN 10
       WHEN "CommandLine" ILIKE '%--flood%' OR "CommandLine" ILIKE '%synflood%' THEN 8
       ELSE 5 END as RiskScore
FROM events
WHERE eventid = 4688
  AND (LOWER("Image") LIKE '%hping%' OR LOWER("Image") LIKE '%loic%' OR LOWER("Image") LIKE '%hoic%'
       OR LOWER("Image") LIKE '%slowloris%' OR LOWER("Image") LIKE '%goldeneye%'
       OR "CommandLine" ILIKE '%--flood%' OR "CommandLine" ILIKE '%--ddos%'
       OR "CommandLine" ILIKE '%synflood%' OR "CommandLine" ILIKE '%udpflood%'
       OR "CommandLine" ILIKE '%-i 0%' OR "CommandLine" ILIKE '%-c 999999%')
ORDER BY EventTime DESC

_sourceCategory=windows/sysmon
| json auto
| where EventID == "1"
| eval ImageLower = toLower(Image)
| eval CmdLower = toLower(CommandLine)
| where matches(ImageLower, "(hping|loic|hoic|slowloris|goldeneye|mausezahn|t50|trinoo|tfn2k|siege|wrk)")
  OR matches(CmdLower, "(--flood|--ddos|-ddos|synflood|udpflood|icmpflood|sendudp|sendtcp|--interval 0|-i 0|-c 999999)")
| eval tool_category = if(matches(ImageLower, "(hping|loic|hoic)"), "known_dos_tool",
    if(matches(CmdLower, "(--flood|synflood|udpflood)"), "flood_flags", "dos_pattern"))
| table _time, Computer, User, Image, CommandLine, ParentImage, tool_category
| sort by _time desc

rule network_dos_tool_execution {
  meta:
    author = "Detection Engineering"
    description = "Detects execution of known DoS/DDoS tools (T1498)"
    severity = "HIGH"
    tactic = "TA0040"

  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    (
      re.regex($e.target.process.file.full_path, `(?i)(hping|loic|hoic|slowloris|goldeneye|mausezahn|t50|trinoo|tfn2k|stacheldraht|siege)`) nocase or
      re.regex($e.target.process.command_line, `(?i)(--flood|--ddos|synflood|udpflood|icmpflood|--interval\s+0|-i\s+0|-c\s+999999)`) nocase
    )

  condition:
    $e
}

#event_simpleName = "ProcessRollup2"
| ImageFileName = /(hping|loic|hoic|slowloris|goldeneye|mausezahn|trinoo|tfn2k|siege)$/i
  OR CommandLine = /(--flood|--ddos|synflood|udpflood|icmpflood|--interval\s+0|-i\s+0|-c\s+999)/i
| eval tool_category = case {
    ImageFileName = /(hping|loic|hoic)/i : "known_dos_tool";
    CommandLine = /(--flood|synflood|udpflood)/i : "flood_flags";
    * : "dos_pattern"
  }
| table timestamp, ComputerName, UserName, ImageFileName, CommandLine, ParentBaseFileName, tool_category
| sort by timestamp desc