DDoS Attack IP Addresses - Percent Threshold

Status: available
Severity: medium
Time window: 2h
Group by: destPublicIpAddress_s
Source: github.com/Azure/Azure-Sentinel

Identifies IP addresses that generate over 5% of traffic during DDoS attack mitigation

MITRE ATT&CK coverage

Tactic	Techniques
Impact	`T1498` Network Denial of Service

Rules detecting the same action

These rules filter on the same operation.

DDoS Attack IP Addresses - PPS Threshold (Kusto)

Rule body

id: 402a42ad-f31c-48d1-8f80-0200846b7f25
kind: Scheduled
name: DDoS Attack IP Addresses - Percent Threshold
description: Identifies IP addresses that generate over 5% of traffic during DDoS attack mitigation
severity: Medium
status : Available
requiredDataConnectors:
  - connectorId: DDOS
    dataTypes:
      - AzureDiagnostics
queryPeriod: 2h
queryFrequency: 2h
triggerOperator: gt
triggerThreshold: 0
query: |
  let T1 = AzureDiagnostics
    | where ResourceType == "PUBLICIPADDRESSES" and Category == "DDoSMitigationFlowLogs"
    | summarize rows_count = count() by destPublicIpAddress_s, sourcePublicIpAddress_s;
  let T2 = AzureDiagnostics
    | where ResourceType == "PUBLICIPADDRESSES" and Category == "DDoSMitigationFlowLogs"
    | summarize rows_total = count() by destPublicIpAddress_s;
  T2
    | join kind=leftouter T1 on destPublicIpAddress_s
    | project destPublicIpAddress_s, sourcePublicIpAddress_s, percent_of_traffic = 100*rows_count/rows_total
    | order by percent_of_traffic desc
    | where percent_of_traffic > 5
eventGroupingSettings:
  aggregationKind: SingleAlert
entityMappings:
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: sourcePublicIpAddress_s
tactics:
  - Impact
relevantTechniques:
  - T1498
version: 1.0.1

Stages and Predicates

Stage 0: `let`

let T1 = AzureDiagnostics
  | where ResourceType == "PUBLICIPADDRESSES" and Category == "DDoSMitigationFlowLogs"
  | summarize rows_count = count() by destPublicIpAddress_s, sourcePublicIpAddress_s;
let T2 = AzureDiagnostics <inlined as stages below>;

Stage 1: `source`

AzureDiagnostics

Stage 2: `where`

| where ResourceType == "PUBLICIPADDRESSES" and Category == "DDoSMitigationFlowLogs"

Stage 3: `summarize`

| summarize rows_total = count() by destPublicIpAddress_s

Stage 4: `join`

| join kind=leftouter T1 on destPublicIpAddress_s

Stage 5: `project`

project destPublicIpAddress_s, percent_of_traffic, sourcePublicIpAddress_s

Stage 6: `sort`

sort by percent_of_traffic

Stage 7: `where`

where percent_of_traffic > 5

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Category`	eq	`DDoSMitigationFlowLogs`	`field:"Category" kind:eq value:"DDoSMitigationFlowLogs"`
`ResourceType`	eq	`PUBLICIPADDRESSES`	`field:"ResourceType" kind:eq value:"PUBLICIPADDRESSES"`
`percent_of_traffic`	gt	`5`	`field:"percent_of_traffic" kind:gt value:"5"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`destPublicIpAddress_s`	`project`
`percent_of_traffic`	`project`
`sourcePublicIpAddress_s`	`project`

DDoS Attack IP Addresses - Percent Threshold

MITRE ATT&CK coverage

Rules detecting the same action

Rule body

Stages and Predicates

Stage 0: let

Stage 1: source

Stage 2: where

Stage 3: summarize

Stage 4: join

Stage 5: project

Stage 6: sort

Stage 7: where