Mastodon and Bluesky DDoS Outages: Volumetric and Application Layer Defense

---
title: Potential HTTP Flood - High Connection Count per Source
id: 8c4d2f1a-6e9b-4a3c-9f5d-1e7b8c9d0a1b
status: experimental
description: Detects a potential HTTP flood by identifying source IPs establishing an abnormally high number of connections to web servers within a short time window.
references:
  - https://attack.mitre.org/techniques/T1498/
author: Security Arsenal
date: 2024/10/26
tags:
  - attack.impact
  - attack.t1498
logsource:
  category: network_connection
  product: windows
 detection:
  selection:
    DestinationPort|startswith:
      - '80'
      - '443'
    Initiated: 'true'
  filter:
    SourceIp|startswith:
      - '10.'
      - '192.168.'
      - '172.16.'
  condition: selection and not filter
  timeframe: 1m
count: 500
falsepositives:
  - Legitimate high-traffic users
  - Vulnerability scanners
level: high
---
title: Linux Web Server Process CPU Spike
id: 9d5e3g2h-7f0c-5b4d-0g6e-2f8c9d0e1f2a
status: experimental
description: Detects high CPU usage by web server processes (Nginx, Apache, Puma) often indicative of resource exhaustion due to Layer 7 DDoS.
references:
  - https://attack.mitre.org/techniques/T1498/
author: Security Arsenal
date: 2024/10/26
tags:
  - attack.impact
  - attack.t1498
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith:
      - '/nginx'
      - '/apache2'
      - '/puma'
      - '/passenger'
    # Assuming CPU usage is logged or derived via auditd/sampling, otherwise this serves as a hunt starter for process spawning anomalies
    CommandLine|contains: 'worker'
falsepositives:
  - Legitimate traffic spikes
  - Scheduled backups/log rotations
level: medium

// KQL Hunt for Potential DDoS Traffic Patterns
// High volume of connections to Web Ports from single IPs
let Threshold = 1000; // Adjust based on baseline traffic
let WebPorts = dynamic([80, 443, 8080]);
DeviceNetworkEvents
| where RemotePort in (WebPorts)
| where ActionType == "ConnectionAccepted" or ActionType == "ConnectionInitiated"
| summarize ConnectionCount = count() by DeviceName, RemoteIP, bin(Timestamp, 5m)
| where ConnectionCount > Threshold
| sort by ConnectionCount desc
| extend Timestamp = format_datetime(Timestamp, 'yyyy-MM-dd HH:mm:ss')

-- Velociraptor VQL Hunt for High Connection Counts
-- Identifies local endpoints with excessive established connections
SELECT count(pid=pid) as ConnectionCount, pid, name, remote_address, state
FROM glob(globs="/*proc/*/net/tcp")
WHERE state =~ "ESTABLISHED"
GROUP BY pid
| WHERE ConnectionCount > 1000

#!/bin/bash
# Remediation: Enable Kernel-Level DDoS Protections (Linux)
# Apply sysctl hardening to mitigate SYN floods and resource exhaustion

echo "[+] Applying Kernel DDoS Hardening..."

# 1. Enable SYN Cookies (protects against SYN flood)
sysctl -w net.ipv4.tcp_syncookies=1

# 2. Reduce SYN-RETRY count to free up resources faster
sysctl -w net.ipv4.tcp_syn_retries=2
sysctl -w net.ipv4.tcp_synack_retries=2

# 3. Decrease the timeout for half-open connections
sysctl -w net.ipv4.tcp_synack_retries=2
sysctl -w net.ipv4.tcp_fin_timeout=15

# 4. Increase the max backlog for pending connections
sysctl -w net.ipv4.tcp_max_syn_backlog=8192
sysctl -w net.core.somaxconn=65535

# 5. Enable IP Spoofing protection
sysctl -w net.ipv4.conf.all.rp_filter=1
sysctl -w net.ipv4.conf.default.rp_filter=1

echo "[+] Hardening applied. Persist these settings in /etc/sysctl.conf"


━━━ END DETECTION CONTENT ━━━