{'created': '2020-03-02T20:08:03.691Z',
 'created_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
 'description': 'Adversaries may attempt to cause a denial of service (DoS) by '
                'reflecting a high-volume of network traffic to a target. This '
                'type of Network DoS takes advantage of a third-party server '
                'intermediary that hosts and will respond to a given spoofed '
                'source IP address. This third-party server is commonly termed '
                'a reflector. An adversary accomplishes a reflection attack by '
                'sending packets to reflectors with the spoofed address of the '
                'victim. Similar to Direct Network Floods, more than one '
                'system may be used to conduct the attack, or a botnet may be '
                'used. Likewise, one or more reflectors may be used to focus '
                'traffic on the target.(Citation: Cloudflare ReflectionDoS May '
                '2017) This Network DoS attack may also reduce the '
                'availability and functionality of the targeted system(s) and '
                'network.\n'
                '\n'
                'Reflection attacks often take advantage of protocols with '
                'larger responses than requests in order to amplify their '
                'traffic, commonly known as a Reflection Amplification attack. '
                'Adversaries may be able to generate an increase in volume of '
                'attack traffic that is several orders of magnitude greater '
                'than the requests sent to the amplifiers. The extent of this '
                'increase will depending upon many variables, such as the '
                'protocol in question, the technique used, and the amplifying '
                'servers that actually produce the amplification in attack '
                'volume. Two prominent protocols that have enabled Reflection '
                'Amplification Floods are DNS(Citation: Cloudflare '
                'DNSamplficationDoS) and NTP(Citation: Cloudflare '
                'NTPamplifciationDoS), though the use of several others in the '
                'wild have been documented.(Citation: Arbor AnnualDoSreport '
                'Jan 2018)  In particular, the memcache protocol showed itself '
                'to be a powerful protocol, with amplification sizes up to '
                '51,200 times the requesting packet.(Citation: Cloudflare '
                'Memcrashed Feb 2018)',
 'external_references': [{'external_id': 'T1498.002',
                          'source_name': 'mitre-attack',
                          'url': 'https://attack.mitre.org/techniques/T1498/002'},
                         {'description': 'Cisco. (n.d.). Detecting and '
                                         'Analyzing Network Threats With '
                                         'NetFlow. Retrieved April 25, 2019.',
                          'source_name': 'Cisco DoSdetectNetflow',
                          'url': 'https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/netflow/configuration/15-mt/nf-15-mt-book/nf-detct-analy-thrts.pdf'},
                         {'description': 'Cloudflare. (n.d.). What is a DNS '
                                         'amplification attack?. Retrieved '
                                         'April 23, 2019.',
                          'source_name': 'Cloudflare DNSamplficationDoS',
                          'url': 'https://www.cloudflare.com/learning/ddos/dns-amplification-ddos-attack/'},
                         {'description': 'Cloudflare. (n.d.). What is a NTP '
                                         'amplificaiton attack?. Retrieved '
                                         'April 23, 2019.',
                          'source_name': 'Cloudflare NTPamplifciationDoS',
                          'url': 'https://www.cloudflare.com/learning/ddos/ntp-amplification-ddos-attack/'},
                         {'description': 'Marek Majkowsk, Cloudflare. (2017, '
                                         'May 24). Reflections on reflection '
                                         '(attacks). Retrieved April 23, 2019.',
                          'source_name': 'Cloudflare ReflectionDoS May 2017',
                          'url': 'https://blog.cloudflare.com/reflections-on-reflections/'},
                         {'description': 'Marek Majkowski of Cloudflare. '
                                         '(2018, February 27). Memcrashed - '
                                         'Major amplification attacks from UDP '
                                         'port 11211. Retrieved April 18, '
                                         '2019.',
                          'source_name': 'Cloudflare Memcrashed Feb 2018',
                          'url': 'https://blog.cloudflare.com/memcrashed-major-amplification-attacks-from-port-11211/'},
                         {'description': 'Philippe Alcoy, Steinthor Bjarnason, '
                                         'Paul Bowen, C.F. Chui, Kirill '
                                         'Kasavchnko, and Gary Sockrider of '
                                         'Netscout Arbor. (2018, January). '
                                         'Insight into the Global Threat '
                                         "Landscape - Netscout Arbor's 13th "
                                         'Annual Worldwide Infrastructure '
                                         'Security Report. Retrieved April 22, '
                                         '2019.',
                          'source_name': 'Arbor AnnualDoSreport Jan 2018',
                          'url': 'https://pages.arbornetworks.com/rs/082-KNA-087/images/13th_Worldwide_Infrastructure_Security_Report.pdf'}],
 'id': 'attack-pattern--36b2a1d7-e09e-49bf-b45e-477076c2ec01',
 'kill_chain_phases': [{'kill_chain_name': 'mitre-attack',
                        'phase_name': 'impact'}],
 'modified': '2025-10-24T17:48:38.890Z',
 'name': 'Reflection Amplification',
 'object_marking_refs': ['marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168'],
 'revoked': False,
 'spec_version': '2.1',
 'type': 'attack-pattern',
 'x_mitre_attack_spec_version': '3.2.0',
 'x_mitre_deprecated': False,
 'x_mitre_detection': '',
 'x_mitre_domains': ['enterprise-attack'],
 'x_mitre_impact_type': ['Availability'],
 'x_mitre_is_subtechnique': True,
 'x_mitre_modified_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
 'x_mitre_platforms': ['Windows', 'IaaS', 'Linux', 'macOS'],
 'x_mitre_version': '1.4'}