ATT&CK T1498 - TCP SYN Flood DoS Attack

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•1

This rule detects a TCP SYN Flood Denial of Service (DoS) attack. It triggers when a high volume of TCP SYN packets (1000 packets within 5 seconds) are observed targeting a single destination IP address within the HOME_NET, indicating an attempt to overwhelm the target's network resources.