[IC] - Detecting attacks based on TCP Flags (DDOS, SYN Flood, and others)
This KQL Query is oriented to extract the different bits of TCP Flags which helps to review the different state of the connections and identify possible threats associated. In addition, it allows to filter by specific TCP Flag to detect specific threats based on every case.
Microsoft Sentinel (KQL)
