Packet flood tool launched with a continuous-send argument

1title: Packet flood tool launched with a continuous-send argument2id: aed598e4-9696-499c-b5ed-e473bd6926693status: experimental4description: |5  Matches the launch of a raw-packet generator either whose only purpose is6  saturation traffic, or which was given an argument that requests continuous or7  rate-driven transmission — `hping3 --flood`, `nping --rate`, `ping -f` — which8  is the only part of AN0970 that a single event can carry. It does not detect a9  flood, and should not be read as though it did: Sigma has no aggregation, so10  MITRE's SyscallBurstCount and packet-rate knobs cannot be expressed at all, and11  a match means only that a tool capable of flooding was started with flooding12  options, never that outbound volume actually became abnormal. Coverage is13  correspondingly weak in the other direction too — a flood driven by a compiled14  dropper, a shell loop around a socket, or a botnet in which each host sends15  very little produces no matching command line, so silence from this rule is no16  evidence that the estate is not being used as a source. Written against the17  `process_creation` category for Linux, whose `CommandLine` field is a18  normalised join of the auditd SYSCALL and EXECVE records; a raw auditd feed19  keeps the arguments in a separate EXECVE record and needs that mapping applied20  before any of the argument selections can match.21  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0343, not hand-written and not tested by its author. Any lab result is on this rule's own page.22references:23  - https://attack.mitre.org/techniques/T1498/00124  - https://attack.mitre.org/detectionstrategies/DET034325author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)26date: 2026-08-1627tags:28  - attack.impact29  - attack.t1498.00130logsource:31  category: process_creation32  product: linux33detection:34  selection_dos_tool:35    Image|endswith:36      - '/t50'37      - '/mz'38      - '/mausezahn'39      - '/slowhttptest'40      - '/hyenae'41  selection_packet_crafter:42    Image|endswith:43      - '/hping'44      - '/hping2'45      - '/hping3'46      - '/nping'47  selection_flood_arg:48    CommandLine|contains:49      - '--flood'50      - '--rand-source'51      - '--faster'52      - '--rate '53      - ' -i u'54  selection_ping:55    Image|endswith:56      - '/ping'57      - '/ping6'58  selection_ping_flood_arg:59    CommandLine|contains: ' -f '60  condition: selection_dos_tool or (selection_packet_crafter and selection_flood_arg) or (selection_ping and selection_ping_flood_arg)61falsepositives:62  - "Network and platform engineers running ping -f to test link quality, path MTU or NIC throughput during a fault investigation or a hardware burn-in. This is ordinary operations work, it is the highest-volume branch of the rule by a wide margin, and nothing in the event distinguishes it from a deliberate flood."63  - "Booked load and resilience testing, where a performance team points slowhttptest or nping at the organisation's own service. The command line is identical to an attack launched from the same host and only the schedule and the target separate them."64  - "Authorised penetration tests and red-team engagements that include availability testing in scope, which is where hping3 --flood is most often seen legitimately."65  - "Lab, training and CTF hosts, where these packages are installed on purpose and exercised as coursework, so every student produces matches for the duration of a course."66level: medium