Packet flood tool launched with a continuous-send argument

Siemphony@siemphonymediumT1498.001unverified

Matches the launch of a raw-packet generator either whose only purpose is saturation traffic, or which was given an argument that requests continuous or rate-driven transmission — `hping3 --flood`, `nping --rate`, `ping -f` — which is the only part of AN0970 that a single event can carry. It does not detect a flood, and should not be read as though it did: Sigma has no aggregation, so MITRE's SyscallBurstCount and packet-rate knobs cannot be expressed at all, and a match means only that a tool capable of flooding was started with flooding options, never that outbound volume actually became abnormal. Coverage is correspondingly weak in the other direction too — a flood driven by a compiled dropper, a shell loop around a socket, or a botnet in which each host sends very little produces no matching command line, so silence from this rule is no evidence that the estate is not being used as a source. Written against the `process_creation` category for Linux, whose `CommandLine` field is a normalised join of the auditd SYSCALL and EXECVE records; a raw auditd feed keeps the arguments in a separate EXECVE record and needs that mapping applied before any of the argument selections can match. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0343, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where (((FolderPath endswith "/t50" or FolderPath endswith "/mz" or FolderPath endswith "/mausezahn" or FolderPath endswith "/slowhttptest" or FolderPath endswith "/hyenae") or ((FolderPath endswith "/hping" or FolderPath endswith "/hping2" or FolderPath endswith "/hping3" or FolderPath endswith "/nping") and (ProcessCommandLine contains "--flood" or ProcessCommandLine contains "--rand-source" or ProcessCommandLine contains "--faster" or ProcessCommandLine contains "--rate " or ProcessCommandLine contains " -i u"))) or ((FolderPath endswith "/ping" or FolderPath endswith "/ping6") and ProcessCommandLine contains " -f "))

Splunk · SPL

Run this as a search.

index=* (((Image="*/t50" OR Image="*/mz" OR Image="*/mausezahn" OR Image="*/slowhttptest" OR Image="*/hyenae") OR ((Image="*/hping" OR Image="*/hping2" OR Image="*/hping3" OR Image="*/nping") AND (CommandLine="*--flood*" OR CommandLine="*--rand-source*" OR CommandLine="*--faster*" OR CommandLine="*--rate *" OR CommandLine="* -i u*"))) OR ((Image="*/ping" OR Image="*/ping6") AND CommandLine="* -f *"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (((TO_LOWER(process.executable) LIKE "*/t50" OR TO_LOWER(process.executable) LIKE "*/mz" OR TO_LOWER(process.executable) LIKE "*/mausezahn" OR TO_LOWER(process.executable) LIKE "*/slowhttptest" OR TO_LOWER(process.executable) LIKE "*/hyenae") OR ((TO_LOWER(process.executable) LIKE "*/hping" OR TO_LOWER(process.executable) LIKE "*/hping2" OR TO_LOWER(process.executable) LIKE "*/hping3" OR TO_LOWER(process.executable) LIKE "*/nping") AND (TO_LOWER(process.command_line) LIKE "*--flood*" OR TO_LOWER(process.command_line) LIKE "*--rand-source*" OR TO_LOWER(process.command_line) LIKE "*--faster*" OR TO_LOWER(process.command_line) LIKE "*--rate *" OR TO_LOWER(process.command_line) LIKE "* -i u*"))) OR ((TO_LOWER(process.executable) LIKE "*/ping" OR TO_LOWER(process.executable) LIKE "*/ping6") AND TO_LOWER(process.command_line) LIKE "* -f *"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,linux,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <!-- 3 rules: the Sigma condition ORs across different fields,       which one rule cannot express. Any one matching is a hit. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for linux so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(/t50$|/mz$|/mausezahn$|/slowhttptest$|/hyenae$)</field>    <description>Packet flood tool launched with a continuous-send argument (1/3)</description>    <mitre>      <id>T1498.001</id>    </mitre>  </rule>   <rule id="100001" level="7">    <!-- Set <if_sid> to the decoder/base rule for linux so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(/hping$|/hping2$|/hping3$|/nping$)</field>    <field name="CommandLine" type="pcre2">(?i)(--flood|--rand-source|--faster|--rate | -i u)</field>    <description>Packet flood tool launched with a continuous-send argument (2/3)</description>    <mitre>      <id>T1498.001</id>    </mitre>  </rule>   <rule id="100002" level="7">    <!-- Set <if_sid> to the decoder/base rule for linux so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(/ping$|/ping6$)</field>    <field name="CommandLine" type="pcre2">(?i) -f </field>    <description>Packet flood tool launched with a continuous-send argument (3/3)</description>    <mitre>      <id>T1498.001</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / linux
Level: medium
Category: impact_destruction
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: aed598e4-9696-499c-b5ed-e473bd692669

ATT&CKT1498.001

T1498.001Direct Network Flood

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonimpact destruction

impact destructionAI draft — unreviewed

01 · What this rule detects

AN0970 describes kernel or userland processes generating high-rate network traffic — ICMP, UDP, TCP SYN — beyond expected throughput. This rule cannot see rate at all: it matches the launch of a packet-generation tool with an argument that requests continuous or rate-driven sending. The description is blunt about the gap: "It does not detect a flood... a match means only that a tool capable of flooding was started with flooding options." A hit is a command line, never a measured packet rate.

02 · Telemetry you need

category: process_creation, product: linux — the normalised join of auditd's SYSCALL and EXECVE records, where CommandLine carries the full argument string. The description flags this explicitly: a raw auditd feed keeps arguments in a separate EXECVE record, and that join has to be applied before any argument selection can match. Sentinel and Splunk/Elastic render this rule (translations.json shows working KQL/SPL/ES|QL); Wazuh refuses because the condition ORs across selections built on different fields.

03 · How the logic works

Three branches joined by OR, only two internally gated. selection_dos_tool matches Image|endswith against five dedicated flood binaries — /t50, /mz, /mausezahn, /slowhttptest, /hyenae — with no argument requirement at all: any invocation counts. selection_packet_crafter matches Image|endswith against /hping, /hping2, /hping3, /nping, ANDed with selection_flood_arg, a CommandLine|contains list of five terms: --flood, --rand-source, --faster, --rate , ' -i u'. selection_ping matches /ping or /ping6, ANDed with selection_ping_flood_arg's single ' -f ' term. The condition is selection_dos_tool or (selection_packet_crafter and selection_flood_arg) or (selection_ping and selection_ping_flood_arg). None of this maps to a named MITRE knob directly — AN0970's SyscallBurstCount (repeated socket calls in a short interval) and UserContext (restrict to non-admin traffic) are both dropped, since Sigma has no aggregation and no privilege-comparison construct. The tool and flag lists are entirely the author's own selection of what "continuous or rate-driven transmission" looks like on the command line.

04 · Common false positives

The review found the false-positive framing contradicts the level: entry 1 says ping -f operators running link-quality tests are "the highest-volume branch of the rule by a wide margin, and nothing in the event distinguishes it from a deliberate flood" — yet the rule ships at level: medium, while sibling rules in the same batch use identical "by a wide margin" language and set low. The review also names an argument-coverage gap: selection_flood_arg only knows short forms, so hping3 --interval u1 (long form of -i u1), --fast (distinct from --faster), and nping --rate=100000 (value attached, no trailing space) all produce a flood with no match. The ' -f ' ping gate requires spaces on both sides, so combined flags like ping -fs 1000 slip through too. In the other direction, selection_dos_tool is ungated, so mausezahn -V or slowhttptest -h — a version check, not a flood — matches every time; the review's missed false positive is exactly this: Ansible command modules, CI smoke tests and distro post-install checks invoking these binaries on a schedule, no flooding involved. Evasion is trivial per the review: copy any binary to a new name and every branch, anchored on Image|endswith, is defeated.

05 · Detection maturity

tier_1: . Never run; the calibration mismatch and the argument gaps were both found by review reasoning against the YAML, not against traffic.
tier_2: run read-only, rank hits by `Image` and by which `selection_flood_arg` term matched, and expect `ping -f` to dominate exactly as the false positives predict.
tier_3: ** pair this launch signal with a volume-based companion — MITRE's SyscallBurstCount knob against connect/sendto syscall bursts — so an alert requires both a flood-capable launch and measured high-rate traffic, not either alone.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Reconcile the level with the false-positive entry — either drop to low, or split the loose ping -f branch out and reserve medium for the dedicated- tool and packet-crafter branches. Add the missing long-form flags (--interval u, --fast, --rate=) to selection_flood_arg. Decide whether selection_dos_tool should require any argument at all, given it currently matches help and version invocations. If the combined-flag gap on ping -f matters in your estate, add a second term rather than relying on ' -f ' alone.

Declared by the author

Network and platform engineers running ping -f to test link quality, path MTU or NIC throughput during a fault investigation or a hardware burn-in. This is ordinary operations work, it is the highest-volume branch of the rule by a wide margin, and nothing in the event distinguishes it from a deliberate flood.
Booked load and resilience testing, where a performance team points slowhttptest or nping at the organisation's own service. The command line is identical to an attack launched from the same host and only the schedule and the target separate them.
Authorised penetration tests and red-team engagements that include availability testing in scope, which is where hping3 --flood is most often seen legitimately.
Lab, training and CTF hosts, where these packages are installed on purpose and exercised as coursework, so every student produces matches for the duration of a course.

Noise check0 of 4 fired

Fires on none of the 4 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 4 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1498.001, evaluated against their process_creation events.

Share this rule

/u/siemphony/aed598e4-9696-499c-b5ed-e473bd692669

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Packet flood tool launched with a continuous-send argument

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it