Esc
Network Denial of Service - T1498

(ATT&CK® Technique)
Subtechniques

Definition

Adversaries may perform Network Denial of Service (DoS) attacks to degrade or block the availability of targeted resources to users. Network DoS can be performed by exhausting the network bandwidth services rely on. Example resources include specific websites, email services, DNS, and web-based applications. Adversaries have been observed conducting network DoS attacks for political purposes and to support other malicious activities, including distraction, hacktivism, and extortion.
D3FEND Inferred Relationships

Browse the D3FEND knowledge graph by clicking on the nodes below.
        graph LR;

     T1498["Network Denial of Service"] --> |creates| InboundInternetNetworkTraffic["Inbound Internet Network Traffic"]; class T1498 OffensiveTechniqueNode;
        class InboundInternetNetworkTraffic ArtifactNode; click InboundInternetNetworkTraffic href "/dao/artifact/d3f:InboundInternetNetworkTraffic";
        click T1498 href "/offensive-technique/attack/T1498/"; click InboundInternetNetworkTraffic href "/dao/artifact/d3f:InboundInternetNetworkTraffic"; T1498["Network Denial of Service"] --> |produces| InboundInternetNetworkTraffic["Inbound Internet Network Traffic"]; class T1498 OffensiveTechniqueNode;
        class InboundInternetNetworkTraffic ArtifactNode; click InboundInternetNetworkTraffic href "/dao/artifact/d3f:InboundInternetNetworkTraffic";
        click T1498 href "/offensive-technique/attack/T1498/"; click InboundInternetNetworkTraffic href "/dao/artifact/d3f:InboundInternetNetworkTraffic";                          NetworkTrafficSignatureAnalysis["Network Traffic Signature Analysis"] -->
          | analyzes | InboundInternetNetworkTraffic["Inbound Internet Network Traffic"];

          NetworkTrafficSignatureAnalysis["Network Traffic Signature Analysis"] -.->
            | may-detect | T1498["Network Denial of Service"] ;
          class NetworkTrafficSignatureAnalysis DefensiveTechniqueNode;
          class InboundInternetNetworkTraffic ArtifactNode;
          click NetworkTrafficSignatureAnalysis href "/technique/d3f:NetworkTrafficSignatureAnalysis";  ProtocolMetadataAnomalyDetection["Protocol Metadata Anomaly Detection"] -->
          | analyzes | InboundInternetNetworkTraffic["Inbound Internet Network Traffic"];

          ProtocolMetadataAnomalyDetection["Protocol Metadata Anomaly Detection"] -.->
            | may-detect | T1498["Network Denial of Service"] ;
          class ProtocolMetadataAnomalyDetection DefensiveTechniqueNode;
          class InboundInternetNetworkTraffic ArtifactNode;
          click ProtocolMetadataAnomalyDetection href "/technique/d3f:ProtocolMetadataAnomalyDetection";                      PerHostDownload-UploadRatioAnalysis["Per Host Download-Upload Ratio Analysis"] -->
          | analyzes | InboundInternetNetworkTraffic["Inbound Internet Network Traffic"];

          PerHostDownload-UploadRatioAnalysis["Per Host Download-Upload Ratio Analysis"] -.->
            | may-detect | T1498["Network Denial of Service"] ;
          class PerHostDownload-UploadRatioAnalysis DefensiveTechniqueNode;
          class InboundInternetNetworkTraffic ArtifactNode;
          click PerHostDownload-UploadRatioAnalysis href "/technique/d3f:PerHostDownload-UploadRatioAnalysis";                     RemoteTerminalSessionDetection["Remote Terminal Session Detection"] -->
          | analyzes | InboundInternetNetworkTraffic["Inbound Internet Network Traffic"];

          RemoteTerminalSessionDetection["Remote Terminal Session Detection"] -.->
            | may-detect | T1498["Network Denial of Service"] ;
          class RemoteTerminalSessionDetection DefensiveTechniqueNode;
          class InboundInternetNetworkTraffic ArtifactNode;
          click RemoteTerminalSessionDetection href "/technique/d3f:RemoteTerminalSessionDetection";            Client-serverPayloadProfiling["Client-server Payload Profiling"] -->
          | analyzes | InboundInternetNetworkTraffic["Inbound Internet Network Traffic"];

          Client-serverPayloadProfiling["Client-server Payload Profiling"] -.->
            | may-detect | T1498["Network Denial of Service"] ;
          class Client-serverPayloadProfiling DefensiveTechniqueNode;
          class InboundInternetNetworkTraffic ArtifactNode;
          click Client-serverPayloadProfiling href "/technique/d3f:Client-serverPayloadProfiling";                       NetworkTrafficCommunityDeviation["Network Traffic Community Deviation"] -->
          | analyzes | InboundInternetNetworkTraffic["Inbound Internet Network Traffic"];

          NetworkTrafficCommunityDeviation["Network Traffic Community Deviation"] -.->
            | may-detect | T1498["Network Denial of Service"] ;
          class NetworkTrafficCommunityDeviation DefensiveTechniqueNode;
          class InboundInternetNetworkTraffic ArtifactNode;
          click NetworkTrafficCommunityDeviation href "/technique/d3f:NetworkTrafficCommunityDeviation";                                                    InboundSessionVolumeAnalysis["Inbound Session Volume Analysis"] -->
          | analyzes | InboundInternetNetworkTraffic["Inbound Internet Network Traffic"];

          InboundSessionVolumeAnalysis["Inbound Session Volume Analysis"] -.->
            | may-detect | T1498["Network Denial of Service"] ;
          class InboundSessionVolumeAnalysis DefensiveTechniqueNode;
          class InboundInternetNetworkTraffic ArtifactNode;
          click InboundSessionVolumeAnalysis href "/technique/d3f:InboundSessionVolumeAnalysis";                                                                UserGeolocationLogonPatternAnalysis["User Geolocation Logon Pattern Analysis"] -->
          | analyzes | InboundInternetNetworkTraffic["Inbound Internet Network Traffic"];

          UserGeolocationLogonPatternAnalysis["User Geolocation Logon Pattern Analysis"] -.->
            | may-detect | T1498["Network Denial of Service"] ;
          class UserGeolocationLogonPatternAnalysis DefensiveTechniqueNode;
          class InboundInternetNetworkTraffic ArtifactNode;
          click UserGeolocationLogonPatternAnalysis href "/technique/d3f:UserGeolocationLogonPatternAnalysis";                            NetworkTrafficFiltering["Network Traffic Filtering"] -->
          | filters | InboundInternetNetworkTraffic["Inbound Internet Network Traffic"];

          NetworkTrafficFiltering["Network Traffic Filtering"] -.->
            | may-isolate | T1498["Network Denial of Service"] ;
          class NetworkTrafficFiltering DefensiveTechniqueNode;
          class InboundInternetNetworkTraffic ArtifactNode;
          click NetworkTrafficFiltering href "/technique/d3f:NetworkTrafficFiltering";                            InboundTrafficFiltering["Inbound Traffic Filtering"] -->
          | filters | InboundInternetNetworkTraffic["Inbound Internet Network Traffic"];

          InboundTrafficFiltering["Inbound Traffic Filtering"] -.->
            | may-isolate | T1498["Network Denial of Service"] ;
          class InboundTrafficFiltering DefensiveTechniqueNode;
          class InboundInternetNetworkTraffic ArtifactNode;
          click InboundTrafficFiltering href "/technique/d3f:InboundTrafficFiltering";
json