StandardCAPEC-482
CAPEC-482: TCP Flood
Description
An adversary may execute a flooding attack using the TCP protocol with the intent to deny legitimate users access to a service. These attacks exploit the weakness within the TCP protocol where there is some state information for the connection the server needs to maintain. This often involves the use of TCP SYN messages.
- Likelihood of attack
- Not rated by MITRE
- Typical severity
- Not rated by MITRE
- Abstraction
- StandardA specific methodology or technique used in an attack.
Mechanism of attack: Abuse Existing Functionality
Prerequisites
- This type of an attack requires the ability to generate a large amount of TCP traffic to send to the target port of a functioning server.
Mitigations
- To mitigate this type of an attack, an organization can monitor incoming packets and look for patterns in the TCP traffic to determine if the network is under an attack. The potential target may implement a rate limit on TCP SYN messages which would provide limited capabilities while under attack.
Related weaknesses (CWE)
ATT&CK techniques (CAPEC taxonomy mapping)
Across MITRE's defensive frameworks
Linked through the 2 ATT&CK techniques above.
Counter with D3FEND
Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.
- D3-ISVAInbound Session Volume Analysis2 shared
- D3-ITFInbound Traffic Filtering2 shared
- D3-APCAApplication Protocol Command Analysis2 shared
- D3-CSPPClient-server Payload Profiling2 shared
- D3-NTCDNetwork Traffic Community Deviation2 shared
- D3-NTFNetwork Traffic Filtering2 shared
- D3-NTSANetwork Traffic Signature Analysis2 shared
- D3-PHDURAPer Host Download-Upload Ratio Analysis2 shared
- D3-PMADProtocol Metadata Anomaly Detection2 shared
- D3-RTSDRemote Terminal Session Detection2 shared
- D3-UGLPAUser Geolocation Logon Pattern Analysis2 shared