Suspicious ICMP traffic that resembles smurf attack

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	1 Hour
Deduplication Period	1 Day
Required Data	XDR Agent
ATT&CK Tactic	Impact (TA0040)
ATT&CK Technique	Endpoint Denial of Service: Service Exhaustion Flood (T1499.002), Network Denial of Service (T1498)
Severity	Low

Description

ICMP smurf attack was used.

Attacker's Goals

Attempt to perform a denial-of-service attack by network exhaustion.

Investigative actions

• Check if the ICMP message to broadcast was used for a legitimate reason.
• If not, check for denial-of-service impact on the subnet.