HighALERT-4217engine: heuristic

UDP Amplification Flood

analyst review

Raw alert — normalized QRadar offense

asset: web-prod-01
protocol: TCP :53
src_ip: 104.18.48.58
dest_ip: 10.20.4.11
magnitude: 6/10
severity: 7/10
credibility: 7/10
relevance: 7/10
src network: external
events / flows: 331,168 / 78,800

triggered rules

▹ DoS: Possible Network DoS Detected
▹ DoS: SYN Flood Against Single Destination

full offense JSON

{
  "offense_id": 4217,
  "description": "UDP Amplification Flood :: DoS/DDoS targeting web-prod-01",
  "offense_type": "Destination IP",
  "offense_source": "104.18.48.58",
  "magnitude": 6,
  "severity": 7,
  "credibility": 7,
  "relevance": 7,
  "status": "OPEN",
  "source_network": "external",
  "destination_networks": [
    "internal_corp"
  ],
  "event_count": 331168,
  "flow_count": 78800,
  "start_time": "2025-11-03T11:36:00+00:00",
  "last_updated_time": "2025-11-03T12:31:00+00:00",
  "categories": [
    "Denial of Service",
    "Network DoS Attack"
  ],
  "rules": [
    "DoS: Possible Network DoS Detected",
    "DoS: SYN Flood Against Single Destination"
  ],
  "assigned_to": null,
  "dest_port": 53
}

AI triage

Likely dos/ddos: UDP Amplification Flood from external source 104.18.48.58 against web-prod-01 (10.20.4.11) over TCP, 331,168 events observed.

MITRE ATT&CK

T1498Network Denial of ServiceImpactconfidence 95%

Alert indicators (UDP Amplification Flood; rules: DoS: Possible Network DoS Detected) overlap most strongly with T1498 Network Denial of Service among the ATT&CK shortlist.

Priority — High

Scored High based on: QRadar magnitude 6/10; high severity (7/10); source is external to the network; credibility 7/10.

Recommended next steps

1.Confirm impact: is the destination service degraded or still responsive?
2.Identify whether traffic is from a single source or distributed; engage upstream/ISP scrubbing if distributed.
3.Apply rate-limiting / SYN-cookie protections on the targeted service.
4.Preserve NetFlow for the attack window for post-incident review.

Suggested hunting query (KQL)

CommonSecurityLog
| where TimeGenerated > ago(24h)
| where SourceIP == "104.18.48.58" and DestinationIP == "10.20.4.11"
| summarize Events=count() by DestinationPort, Protocol
| order by Events desc

ATT&CK candidate shortlist — matched before the model was called, so it justifies from real technique IDs

T1498Network Denial of Service·13.5T1499Endpoint Denial of Service·11.5T1498.001Direct Network Flood·8T1499.002Service Exhaustion Flood·8T1499.001OS Exhaustion Flood·7.5T1499.003Application Exhaustion Flood·6.5T1498.002Reflection Amplification·5.5