Analytics Low
✕

Suspicious ICMP traffic that resembles smurf attack

ICMP smurf attack was used.

Module:
Platform Analytics
Data source:
XDR Agent
ATT&CK tactics: Impact (TA0040)
ATT&CK techniques: Endpoint Denial of Service: Service Exhaustion Flood (T1499.002) Network Denial of Service (T1498)
Attacker's goals:

Attempt to perform a denial-of-service attack by network exhaustion.

Investigative actions:

Check if the ICMP message to broadcast was used for a legitimate reason. If not, check for denial-of-service impact on the subnet.

Test period:
1 Hour
Deduplication:
1 Day