Splunk Search

How to search for script creating an “outbound denial of service attack (DOS)”

canton
New Member

I’ve just been told by my hosting company that my server is creating an “outbound denial of service attack (DOS)”.

Hosting company firewall logs show:-

09:52:17.768667 IP [local IP address].55901 > [destination IP address].113: UDP, length 1

09:52:17.768680 IP [local IP address].55901 > [destination IP address].113: UDP, length 1

09:52:17.768683 IP [local IP address].55901 > [destination IP address].113: UDP, length 1

09:52:17.768686 IP [local IP address].55901 > [destination IP address].113: UDP, length 1

09:52:17.768688 IP [local IP address].55901 > [destination IP address].113: UDP, length 1

….And so on
So I now have to trace the script e.t.c that is being used to create this attack.
How do I go about investigating the source of the problem? I use a tool called splunk if that helps.

Thanks in advance

Tags (1)
0 Karma

mikelanghorst
Motivator

If you have the *nix app running, and lsof enabled, you might be able to track it down by starting with the following search:
index=os sourcetype=lsof UDP | multikv | search

That will search for lsof events that contain UDP, break it into individual lines, then filter only those with destination IP.

Brian_Osburn
Builder

This isn't making very much sense. It looks like you're trying to connect from your server to port 113 on another server. Most likely you have some misconfigured application on your server. Unless you are indexing the application logs (and the logs themselves show connections), Splunk isn't going to be much help.

Best bet will be to do (if you have a *nix) box, is to do lsof | grep 113 - this will tell you what process is trying to connect.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...