TA0040 · IMPACT
Network Denial of Service
Flooding the network or an application to make it unavailable, sometimes as a distraction.
Detect it with
Bandwidth saturation, connection-table exhaustion, upstream provider alerts.
Why it matters on shift
Network Denial of Service is one of the concrete ways adversaries achieve impact. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After impact, the next tactic is usually Impact. Search your telemetry for the transition before closing the ticket.
2 sub-techniques
How it shows up in practice
- T1498.001
Direct Network Flood
Adversaries may attempt to cause a denial of service (DoS) by directly sending a high-volume of network traffic to a target. This DoS attack may also reduce the availability and functionality of the targeted system(s) and network.
- T1498.002
Reflection Amplification
Adversaries may attempt to cause a denial of service (DoS) by reflecting a high-volume of network traffic to a target.
Kill-chain context