1. Prerequisites
Before starting this runbook, ensure the following:
- DDoS activity has been validated
- Incident ticket has been created
- Network telemetry is available
- Firewall logs are available
- CDN telemetry is available where applicable
- WAF logs are available where applicable
- Cloud provider telemetry is available where applicable
- NetFlow or equivalent telemetry is available where applicable
2. Step-by-Step Instructions
-
Establish Attack Timeline
Determine:
- Attack start time
- Detection time
- Peak activity period
- Current attack status
- Attack duration
Build a timeline of observed activity.
Document findings.
-
Identify Targeted Assets
Determine:
- Targeted IP addresses
- Targeted domains
- Targeted applications
- Targeted APIs
- Targeted services
- Targeted network infrastructure
Identify primary and secondary targets.
Document findings.
-
Analyse Traffic Volume
Review:
- Total bandwidth utilisation
- Packets per second (PPS)
- Requests per second (RPS)
- Concurrent connections
- Peak traffic volume
- Historical baselines
Determine the scale of the attack.
Document findings.
-
Identify Attack Type
Determine whether the activity represents:
- Volumetric DDoS
- Protocol DDoS
- Application-layer DDoS
- HTTP flood
- HTTPS flood
- DNS flood
- SYN flood
- UDP flood
- Amplification attack
- Reflection attack
- Multi-vector attack
Document attack classification.
-
Analyse Source Distribution
Review:
- Source IP addresses
- Autonomous System Numbers (ASNs)
- Geographic distribution
- Hosting providers
- Cloud providers
- Botnet indicators
Determine:
- Concentrated attack sources
- Distributed attack sources
- Spoofing indicators
Document findings.
-
Identify Amplification or Reflection Activity
Review for:
- DNS amplification
- NTP amplification
- SSDP amplification
- CLDAP amplification
- Memcached amplification
- Reflection behaviour
Identify:
- Amplifiers involved
- Reflection infrastructure
- Potential abuse vectors
Document findings.
-
Analyse Traffic Characteristics
Review:
- Request methods
- User agents
- Headers
- Protocols
- URI patterns
- Connection behaviour
- Session behaviour
Identify:
- Repetitive requests
- Automated behaviour
- Bot activity
- Attack signatures
Document findings.
-
Assess Mitigation Effectiveness
Review:
- CDN performance
- WAF effectiveness
- Rate limiting effectiveness
- Filtering effectiveness
- Upstream mitigation effectiveness
Determine:
- Current mitigation status
- Remaining attack impact
- Additional controls required
Document findings.
-
Assess Secondary Indicators
Review for:
- Concurrent authentication anomalies
- Privilege escalation attempts
- Cloud activity anomalies
- Data access anomalies
- Suspicious administrative activity
Determine whether DDoS activity may be supporting another attack objective.
Escalate where appropriate.
-
Update Incident Record
Record:
- Attack timeline
- Targeted assets
- Traffic volumes
- Attack classification
- Source analysis
- Mitigation effectiveness
- Secondary observations
Attach supporting evidence.
3. Post-Action
Upon completion:
- Ensure attack classification is documented
- Ensure targeted assets are identified
- Ensure source analysis is completed
- Ensure mitigation effectiveness is assessed
- Ensure secondary attack indicators are reviewed
- Ensure supporting evidence is attached
- Ensure incident ticket is updated
Contributor
Vishal Thakur GitHub: https://github.com/malienist
Contributed to the Arcana Incident Response Documentation Framework.