TA0040 · IMPACT
Direct Network Flood
Adversaries may attempt to cause a denial of service (DoS) by directly sending a high-volume of network traffic to a target. This DoS attack may also reduce the availability and functionality of the targeted system(s) and network.
Detect it with
Detection of a network flood can sometimes be achieved before the traffic volume is sufficient to cause impact to the availability of the service, but such response time typically requires very aggressive monitoring and responsiveness or services provided by an upstream network…
Why it matters on shift
Direct Network Flood is one of the concrete ways adversaries achieve impact. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After impact, the next tactic is usually Impact. Search your telemetry for the transition before closing the ticket.
Kill-chain context