Detect Network Denial of Service in Sumo Logic CSE
Adversaries may perform Network Denial of Service (DoS) attacks to degrade or block the availability of targeted resources to users. Network DoS can be performed by exhausting the network bandwidth services rely on. This includes direct network floods and reflection amplification attacks targeting websites, DNS, email services, and web-based applications. Attackers may use botnets, IP spoofing, and distributed systems to amplify attack volume and obscure the origin. Real-world usage includes APT28 DDoS attacks against WADA, NKAbuse malware with multi-protocol DoS capabilities, and Lucifer malware executing TCP/UDP/HTTP floods.
MITRE ATT&CK
- Tactic
- Impact
- Technique
- T1498 Network Denial of Service
- Canonical reference
- https://attack.mitre.org/techniques/T1498/
Sumo Detection Query
_sourceCategory=windows/sysmon
| json auto
| where EventID == "1"
| eval ImageLower = toLower(Image)
| eval CmdLower = toLower(CommandLine)
| where matches(ImageLower, "(hping|loic|hoic|slowloris|goldeneye|mausezahn|t50|trinoo|tfn2k|siege|wrk)")
OR matches(CmdLower, "(--flood|--ddos|-ddos|synflood|udpflood|icmpflood|sendudp|sendtcp|--interval 0|-i 0|-c 999999)")
| eval tool_category = if(matches(ImageLower, "(hping|loic|hoic)"), "known_dos_tool",
if(matches(CmdLower, "(--flood|synflood|udpflood)"), "flood_flags", "dos_pattern"))
| table _time, Computer, User, Image, CommandLine, ParentImage, tool_category
| sort by _time descDetects DoS tool execution via Sysmon process creation logs in Sumo Logic.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate load testing tools (Apache Bench, siege, wrk, k6) used by QA or DevOps teams against internal or staging systems
- Network scanners (Nmap, Masscan) run by authorized penetration testers or vulnerability management platforms
- High-volume legitimate services such as CDN edge nodes, torrent clients, or P2P applications that generate many simultaneous outbound connections
- Security research environments or honeypot systems configured to generate high connection volumes for traffic analysis
- Monitoring or synthetic testing agents that make frequent connections to multiple endpoints for uptime checks
Other platforms for T1498
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1hping3 SYN Flood Simulation (Linux)
Expected signal: Linux audit log (auditd): execve syscall for hping3 with arguments --syn --flood. Syslog: process creation event for hping3. /proc/<PID>/net/tcp: rapid socket creation and teardown on loopback. If auditd is configured with EXECVE rules, Event type=EXECVE will capture the full command line.
- Test 2PowerShell UDP Flood Script (Windows)
Expected signal: Sysmon Event ID 1: Process Create for powershell.exe with CommandLine containing UdpClient and 127.0.0.1. Sysmon Event ID 3: 1000 UDP network connection events from powershell.exe to 127.0.0.1:19999. PowerShell ScriptBlock Log Event ID 4104: full script including UdpClient instantiation and send loop.
- Test 3LOIC-style HTTP Flood via curl Loop (Linux/macOS)
Expected signal: Linux audit log: 200 execve syscalls for curl in rapid succession from the same parent shell PID. Syslog: process creation events for curl children. Network: 200 TCP connection attempts to 127.0.0.1:80 in rapid succession. Process table (ps aux) will show many curl processes during execution.
- Test 4nping ICMP Flood (Linux)
Expected signal: Linux audit log: execve for nping with --icmp --rate 500 arguments. If sysmon-for-linux is deployed, Sysmon Event ID 1 will capture the full command line. Network monitoring: 1000 ICMP packets at 500 packets/second burst on loopback. /proc/net/snmp ICMP InMsgs counter increments rapidly during test.
References (8)
- https://attack.mitre.org/techniques/T1498/
- https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/netflow/configuration/15-mt/nf-15-mt-book/nf-detct-analy-thrts.pdf
- https://www.ic3.gov/Media/PDF/Y2012/FraudAlertFinancialInstitutionEmployeeCredentialsTargeted.pdf
- https://learn.microsoft.com/en-us/azure/ddos-protection/ddos-protection-overview
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-devicenetworkevents-table
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1498/T1498.md
- https://github.com/SigmaHQ/sigma/tree/master/rules/network
- https://securelist.com/nkabuse-a-new-multi-platform-threat-abusing-the-nkn-protocol/111278/
Unlock Pro Content
Get the full detection package for T1498 including response playbook, investigation guide, and atomic red team tests.