High-volume packet generation by local processes (e.g., PowerShell, cmd, curl.exe) or network service processes resulting in excessive outbound traffic over short time window, correlated with abnormal resource usage or degraded host responsiveness.
| Data Component | Name | Channel |
|---|---|---|
| Network Connection Creation (DC0082) | WinEventLog:Sysmon | EventCode=3 |
| Process Creation (DC0032) | WinEventLog:Security | EventCode=4688 |
| Field | Description |
|---|---|
| PacketRateThreshold | Defines the burst threshold (e.g., 10,000 pps) above which activity should be flagged as anomalous. |
| TimeWindow | Duration over which to aggregate and analyze flow volume. |
Kernel or userland processes generating high-rate network traffic (ICMP, UDP, TCP SYN) beyond expected interface throughput or user behavior norms.
| Data Component | Name | Channel |
|---|---|---|
| Network Traffic Flow (DC0078) | auditd:SYSCALL | connect or sendto system call with burst pattern |
| Process Creation (DC0032) | auditd:SYSCALL | execve |
| Field | Description |
|---|---|
| SyscallBurstCount | Threshold of repeated socket calls within a short interval indicating flood behavior. |
| UserContext | Restrict to non-admin user traffic unless elevated access is detected. |
Excessive outbound traffic via ping, curl, or custom scripts indicating flooding behavior, especially with no UI context or user interaction.
| Data Component | Name | Channel |
|---|---|---|
| Process Creation (DC0032) | macos:unifiedlog | process created with repeated ICMP or UDP flood behavior |
| Network Traffic Flow (DC0078) | macos:unifiedlog | sudden burst in outgoing packets from same PID |
| Field | Description |
|---|---|
| BurstTimeWindow | Tunable range (e.g., 15s, 30s) for detecting packet floods. |
VM or cloud instance generating anomalously high network egress targeting same destination IP or service, especially using stateless protocols.
| Data Component | Name | Channel |
|---|---|---|
| Network Traffic Flow (DC0078) | AWS:VPCFlowLogs | source instance sends large volume of traffic in short window |
| Host Status (DC0018) | CloudWatch:InstanceMetrics | NetworkOut spike beyond baseline |
| Field | Description |
|---|---|
| InstanceTrafficThreshold | Alert when egress exceeds normal usage by X%. |
| ProtocolType | Prioritize alerts on stateless protocols such as UDP and ICMP. |