AN0969
Analytic 0969
Windows
High-volume packet generation by local processes (e.g., PowerShell, cmd, curl.exe) or network service processes resulting in excessive outbound traffic over short time window, correlated with abnormal resource usage or degraded host responsiveness.
WinEventLog:Sysmon
EventCode=3, 22
WinEventLog:Security
EventCode=4688
[PacketRateThreshold]
Defines the burst threshold (e.g., 10,000 pps) above which activity should be flagged as anomalous.
[TimeWindow]
Duration over which to aggregate and analyze flow volume.
AN0970
Analytic 0970
Linux
Kernel or userland processes generating high-rate network traffic (ICMP, UDP, TCP SYN) beyond expected interface throughput or user behavior norms.
auditd:SYSCALL
connect or sendto system call with burst pattern
auditd:SYSCALL
execve
[SyscallBurstCount]
Threshold of repeated socket calls within a short interval indicating flood behavior.
[UserContext]
Restrict to non-admin user traffic unless elevated access is detected.
AN0971
Analytic 0971
macOS
Excessive outbound traffic via `ping`, `curl`, or custom scripts indicating flooding behavior, especially with no UI context or user interaction.
macos:unifiedlog
process created with repeated ICMP or UDP flood behavior
macos:unifiedlog
sudden burst in outgoing packets from same PID
[BurstTimeWindow]
Tunable range (e.g., 15s, 30s) for detecting packet floods.
AN0972
Analytic 0972
IaaS
VM or cloud instance generating anomalously high network egress targeting same destination IP or service, especially using stateless protocols.
AWS:VPCFlowLogs
source instance sends large volume of traffic in short window
AWS:CloudWatch
NetworkOut spike beyond baseline
[InstanceTrafficThreshold]
Alert when egress exceeds normal usage by X%.
[ProtocolType]
Prioritize alerts on stateless protocols such as UDP and ICMP.