Detect Reflection Amplification in IBM QRadar
Adversaries may attempt to cause a denial of service (DoS) by reflecting a high-volume of network traffic to a target using third-party server intermediaries (reflectors). The attacker sends UDP packets to publicly accessible servers with the victim's spoofed source IP address, causing those servers to direct large responses at the victim. This technique exploits protocols whose responses are significantly larger than requests — known as amplification. Prominent amplification vectors include DNS (ANY queries, amplification factor ~28–54x), NTP (monlist command, up to 700x), memcached UDP (up to 51,200x), SSDP (up to 30x), CLDAP/LDAP (up to 70x), and CharGen (up to 358x). Because UDP allows source IP spoofing without a three-way handshake, attackers can direct enormous response volumes at a victim with minimal bandwidth cost. Multiple compromised systems (botnets) are commonly used to multiply the effect. Impacts include network link saturation, upstream provider congestion, and complete unavailability of internet-facing services.
MITRE ATT&CK
- Tactic
- Impact
- Technique
- T1498 Network Denial of Service
- Sub-technique
- T1498.002 Reflection Amplification
- Canonical reference
- https://attack.mitre.org/techniques/T1498/002/
QRadar Detection Query
SELECT
DATEFORMAT(STARTTIME, 'yyyy-MM-dd HH:mm') AS TimeWindow,
destinationip AS VictimIP,
COUNT(*) AS ConnectionCount,
COUNT(DISTINCT sourceip) AS UniqueSourceIPs,
SUM(sourcebytes) AS TotalBytesReceived,
ROUND(SUM(sourcebytes) / 1073741824.0, 3) AS GbReceived,
CASE
WHEN sourceport = 53 THEN 'DNS Amplification'
WHEN sourceport = 123 THEN 'NTP Amplification'
WHEN sourceport = 11211 THEN 'Memcached Amplification'
WHEN sourceport = 1900 THEN 'SSDP Amplification'
WHEN sourceport = 389 THEN 'CLDAP Amplification'
WHEN sourceport = 5353 THEN 'mDNS Amplification'
WHEN sourceport = 161 THEN 'SNMP Amplification'
WHEN sourceport = 17 THEN 'QOTD Amplification'
WHEN sourceport = 19 THEN 'CharGen Amplification'
WHEN sourceport = 5683 THEN 'CoAP Amplification'
WHEN sourceport = 1434 THEN 'MSSQL Amplification'
WHEN sourceport = 520 THEN 'RIP Amplification'
ELSE 'Generic Reflection Amplification'
END AS PrimaryAttackType,
sourceport AS AmplificationPort
FROM flows
WHERE LAST 60 MINUTES
AND transportprotocol = 17
AND sourceport IN (53, 123, 11211, 1900, 389, 5353, 161, 17, 19, 5683, 1434, 520)
GROUP BY
DATEFORMAT(STARTTIME, 'yyyy-MM-dd HH:mm'),
destinationip,
sourceport,
CASE
WHEN sourceport = 53 THEN 'DNS Amplification'
WHEN sourceport = 123 THEN 'NTP Amplification'
WHEN sourceport = 11211 THEN 'Memcached Amplification'
WHEN sourceport = 1900 THEN 'SSDP Amplification'
WHEN sourceport = 389 THEN 'CLDAP Amplification'
WHEN sourceport = 5353 THEN 'mDNS Amplification'
WHEN sourceport = 161 THEN 'SNMP Amplification'
WHEN sourceport = 17 THEN 'QOTD Amplification'
WHEN sourceport = 19 THEN 'CharGen Amplification'
WHEN sourceport = 5683 THEN 'CoAP Amplification'
WHEN sourceport = 1434 THEN 'MSSQL Amplification'
WHEN sourceport = 520 THEN 'RIP Amplification'
ELSE 'Generic Reflection Amplification'
END
HAVING COUNT(*) > 500 OR COUNT(DISTINCT sourceip) > 25
ORDER BY ConnectionCount DESCDetects UDP reflection amplification DDoS attacks (T1498.002) using QRadar AQL against QFlow network flow data. Queries the flows table for high-volume UDP traffic (transportprotocol=17) sourced from known amplification service ports and directed at a single destination IP within 1-minute time windows. The victim IP is identified as the destination receiving the spoofed-source reflector responses. Triggers when a destination IP receives more than 500 UDP flows or traffic from more than 25 distinct source IPs within the window from any single amplification port. Deploy as a QRadar custom rule with Custom Event Properties mapped from AQL results, or schedule as an offense-generating rule with magnitude scoring.
Data Sources
Required Tables
False Positives & Tuning
- Organizations hosting authoritative DNS servers or high-capacity recursive resolvers — legitimate DNS infrastructure regularly receives high volumes of UDP/53 responses from many distinct client IPs, which matches the victim-side flood pattern and may exceed both thresholds
- NTP infrastructure or pool participants — NTP servers (pool.ntp.org members or enterprise stratum-2 servers) responding to many client sync requests generate high UDP/123 flow volumes that match the inbound flood signature
- Authorized DDoS resilience testing or penetration testing engagements — volumetric testing exercises should be suppressed via QRadar Building Blocks referencing a managed IP group for known test sources and windows
- SNMP management infrastructure at scale — network management systems polling hundreds of devices will receive high volumes of UDP/161 SNMP responses to a central collector IP, potentially exceeding the connection count threshold
- mDNS/Bonjour-heavy environments — large office or campus networks with many Apple or IoT devices generating multicast DNS traffic (UDP/5353) may produce elevated connection counts from many unique source IPs to local subnets
Other platforms for T1498.002
Testing Methodology
Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1DNS ANY Query Amplification Probe
Expected signal: Sysmon Event ID 22 (DNS Query) if Sysmon is configured. Zeek/Bro dns.log entry showing qtype=ANY. Network flow logs showing UDP packet to dst_port=53. The response packet will be significantly larger than the query packet.
- Test 2NTP Monlist Request — Amplification Vector Validation
Expected signal: Network flow log showing outbound UDP to dst_port=123. If ntpdc is used, expect a UDP packet of ~48 bytes sent and potentially a large multi-packet response if the server is vulnerable. Zeek/Bro will log this as a bro:ntp or zeek:ntp event.
- Test 3Memcached UDP Statistics Request
Expected signal: Network flow log showing UDP connection to dst_port=11211. If memcached responds, the response bytes will be significantly larger than the 16-byte request. Sysmon Event ID 3 (Network Connection) if running on Windows with a memcached instance. Zeek/Bro conn.log entry with orig_bytes vs resp_bytes showing amplification ratio.
- Test 4SSDP M-SEARCH Amplification Discovery
Expected signal: Network flow log showing outbound UDP to dst_ip=239.255.255.250 (multicast) dst_port=1900. Inbound UDP responses from local SSDP-capable devices to src_port=1900. Sysmon Event ID 3 (Network Connection) on Windows. Zeek/Bro conn.log showing the multicast connection.
- Test 5High-Volume UDP Flood Simulation to Amplification Ports (hping3)
Expected signal: NetFlow/IPFIX records showing 1000+ UDP packets to dst_port=53 and 123 from src_ip=127.0.0.1. Sysmon Event ID 3 (Network Connection) may not capture loopback traffic — use external lab IP for Sysmon telemetry. Firewall logs or Zeek/Bro conn.log showing packet counts exceeding 1000 per minute on amplification ports.
References (13)
- https://attack.mitre.org/techniques/T1498/002/
- https://www.cloudflare.com/learning/ddos/dns-amplification-ddos-attack/
- https://www.cloudflare.com/learning/ddos/ntp-amplification-ddos-attack/
- https://blog.cloudflare.com/memcrashed-major-amplification-attacks-from-port-11211/
- https://blog.cloudflare.com/reflections-on-reflections/
- https://pages.arbornetworks.com/rs/082-KNA-087/images/13th_Worldwide_Infrastructure_Security_Report.pdf
- https://www.cisa.gov/sites/default/files/publications/understanding-and-responding-to-ddos-attacks_508c.pdf
- https://learn.microsoft.com/en-us/azure/ddos-protection/ddos-protection-overview
- https://learn.microsoft.com/en-us/azure/network-watcher/nsg-flow-logs-overview
- https://docs.splunk.com/Documentation/StreamApp/latest/DeployStreamApp/AboutSplunkStream
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1498.002/T1498.002.md
- https://www.rfc-editor.org/rfc/rfc2827
- https://nvd.nist.gov/vuln/detail/CVE-2013-5211
Unlock Pro Content
Get the full detection package for T1498.002 including response playbook, investigation guide, and atomic red team tests.