ATT&CK T1498 - UDP Flood DoS Attack

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•1

This rule detects a UDP flood Denial of Service (DoS) attack targeting the home network. It triggers an alert if more than 1000 UDP packets are observed from any source to any destination within the home network within a 5-second interval, tracked per destination.