ATT&CK T1498 - ICMP Flood DoS Attack

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•6

This rule detects an ICMP flood Denial of Service (DoS) attack. It triggers an alert when more than 200 ICMP echo request (type 8) packets are observed targeting a single destination within a 5-second window. This high volume of ICMP traffic is indicative of an attempt to overwhelm a target system or network, leading to service disruption.