AN1140
Analytic 1140
Windows
Outbound spoofed traffic to known amplification protocols (e.g., DNS, NTP, Memcached) combined with abnormal network traffic volume targeting remote reflectors, resulting in disproportionate traffic returned to a victim
WinEventLog:Sysmon
EventCode=3, 22
Windows:perfmon
Sudden spike in outbound throughput without corresponding inbound traffic
[TimeWindow]
Interval for measuring sudden outbound spike or volume pattern
[AmplificationProtocolPorts]
List of known ports used for reflection amplification (e.g., 53/DNS, 123/NTP, 11211/Memcached)
[PacketToByteRatio]
Heuristic threshold where the response volume far outweighs the request volume
AN1141
Analytic 1141
Linux
Spoofed outbound packets sent to amplification services from command-line tools or scripts, combined with abnormal outbound packet volume on known reflector ports
auditd:SYSCALL
Execution of spoofing tools (e.g., hping3, nping, scapy) sending UDP packets to known amplifier ports
NSM:Flow
Outbound UDP floods targeting common reflection services with spoofed IP headers
sar:network
Outbound network saturation with minimal process activity
[TimeWindow]
Sliding interval for detecting volumetric anomalies
[AmplificationProtocolList]
Which protocols to watch (e.g., DNS, NTP, SSDP, Memcached)
[ExecutionToolList]
Set of binaries and scripts commonly abused for spoofing/reflection
AN1142
Analytic 1142
macOS
Command-line initiated UDP traffic bursts to external reflection amplification ports using built-in scripting or binaries with network anomalies
macos:unifiedlog
Execution of ping, nping, or crafted network packets via bash or python to reflection services
macos:unifiedlog
Outbound UDP spikes to external reflector IPs
[ReflectionPorts]
Ports known for reflection abuse — DNS, NTP, SSDP, Memcached
[TrafficSpikeThreshold]
How much deviation in outbound traffic constitutes a suspicious spike
AN1143
Analytic 1143
IaaS
Cloud-hosted VM or container generates spoofed UDP requests to third-party services on known amplifier ports, with high outbound-to-inbound traffic ratios in VPC Flow Logs
AWS:CloudTrail
Create egress rule allowing UDP to port 53, 123, 11211
AWS:VPCFlowLogs
Large outbound UDP traffic to multiple public reflector IPs
AWS:CloudWatch
Sudden spike in network output without a corresponding inbound request ratio
[EgressRulePorts]
Cloud security group rules permitting UDP to reflector protocols
[OutboundToInboundRatio]
Ratio threshold to flag traffic as potential reflection behavior
[VMInstanceTagContext]
Cloud metadata that can help scope anomalous behavior to development, testing, or external-facing services