Techniques › T1498.001 › AN0969
AN0969 Analytic 0969
Windows · attack.mitre.org · ATT&CK Enterprise v19.2
<p>High-volume packet generation by local processes (e.g., PowerShell, cmd, curl.exe) or network service processes resulting in excessive outbound traffic over short time window, correlated with abnormal resource usage or degraded host responsiveness.</p>
- Detects
- T1498.001 Direct Network Flood
- Part of
- DET0343 Direct Network Flood Detection across IaaS, Linux, Windows, and macOS
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| WinEventLog:Sysmon | EventCode=3, 22 | DC0082 Network Connection Creation |
| WinEventLog:Security | EventCode=4688 | DC0032 Process Creation |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
PacketRateThreshold | Defines the burst threshold (e.g., 10,000 pps) above which activity should be flagged as anomalous. |
TimeWindow | Duration over which to aggregate and analyze flow volume. |
KEV CVEs whose mapped technique this analytic detects
| CVE | Vendor / product | State |
|---|---|---|
| CVE-2024-45195 | Apache OFBiz | Mapped |