AN1012
Analytic 1012
Windows
Burst of incomplete TCP handshakes (e.g., SYN floods) or uncorrelated ACK packets targeting the state table resulting in OS resource exhaustion.
WinEventLog:Sysmon
EventCode=1
WinEventLog:Microsoft-Windows-TCPIP
Connection queue overflow or failure to allocate TCP state object
NSM:Firewall
High rate of inbound TCP SYN or ACK packets with missing 3-way handshake completion
[TimeWindow]
Threshold for burst traffic over short period (e.g., 30s - 2min)
[ConnectionRateThreshold]
SYN/ACK packet rate threshold that triggers investigation
[ProcessParentCheck]
Whether parent process of flooding tool is a known admin shell or unexpected context
AN1013
Analytic 1013
Linux
Flood of spoofed SYN or ACK packets causing exhaustion of OS TCP state table, potentially via user-space utilities or kernel-level DoS agents.
auditd:SYSCALL
Invocation of packet generation tools (e.g., hping3, nping) or fork bombs
NSM:Flow
High volumes of SYN/ACK packets with unacknowledged TCP handshakes
NSM:Flow
TCP: possible SYN flood or backlog limit exceeded
[AmplificationThreshold]
Volume of fake TCP requests before OS begins degradation
[Interface]
Which network interface is being targeted or impacted
AN1014
Analytic 1014
macOS
Adversary tool/script issuing mass SYN/ACK floods that degrade OS responsiveness and interrupt service response on macOS endpoints.
macos:unifiedlog
network stack resource exhaustion, tcp_accept queue overflow, repeated resets
macos:osquery
Execution of flooding tools or compiled packet generators
NSM:Firewall
Anomalous TCP SYN or ACK spikes from specific source or interface
[SystemLoadThreshold]
Observed CPU/network degradation level that triggers response
[ToolExecutionPath]
Where DoS tools are commonly dropped or compiled