AN1143: Analytic 1143
Cloud-hosted VM or container generates spoofed UDP requests to third-party services on known amplifier ports, with high outbound-to-inbound traffic ratios in VPC Flow Logs
Analyst context for executives and security teams
This analytic matters because it points to a cloud workload behaving like a source of spoofed UDP amplification traffic: a VM or container sends outbound UDP requests to third-party services on known amplifier ports, with traffic volume that is much higher outbound than inbound in VPC Flow Logs. For leaders, the business issue is not just malware detection; it is whether cloud assets can be abused in a way that creates service provider complaints, emergency containment decisions, cost spikes, and reputational or compliance questions about cloud governance.
Executive priority
Treat this as a cloud security and incident response readiness validation. Executives should ask whether teams can quickly identify which IaaS VM or container produced suspicious UDP egress, who owns it, whether spoofed traffic is possible in the environment, and what approval path exists to contain it without disrupting business workloads. This also supports audit and compliance evidence around cloud logging, network egress governance, and incident response procedures.
Technical view
The supplied ATT&CK object is a detection analytic for IaaS environments. The key validation point is whether VPC Flow Logs or equivalent cloud network telemetry can show UDP egress from a cloud-hosted VM or container to third-party services on known amplifier ports, especially where outbound traffic materially exceeds inbound traffic. SOC and detection engineering teams should confirm that flow logs include source workload identity, destination IP and port, protocol, byte/packet counts, timestamps, and VPC/subnet context sufficient to triage and scope the behavior. Because no official detection logic or tactic mapping is provided, local baselining and cloud architecture context are required before turning this into high-confidence alerting.
Likely telemetry
- VPC Flow Logs or equivalent IaaS network flow records
- Cloud workload metadata linking IP addresses to VMs, containers, subnets, VPCs, accounts, projects, or resource owners
- UDP destination port, destination IP, protocol, bytes, packets, and timestamp fields
- Inbound-versus-outbound traffic volume ratios for the same workload over defined time windows
- Cloud asset inventory and ownership records for triage and containment decisions
Detection direction
- Validate that VPC Flow Logs are enabled and retained for the IaaS environments where VMs or containers run.
- Build or tune analytics for UDP egress to third-party services on known amplifier ports combined with unusually high outbound-to-inbound traffic ratios.
- Use workload ownership, subnet purpose, and approved service patterns to reduce false positives from legitimate high-volume UDP applications.
- Confirm that detections can identify the originating VM or container, not only the NAT gateway, load balancer, or shared egress point.
- Account for blind spots where flow logging is disabled, sampled, delayed, lacks packet/byte fields, or loses workload attribution behind shared cloud egress paths.
Mitigation priorities
- Prioritize complete cloud network flow logging and asset attribution before relying on this analytic operationally.
- Review cloud egress controls for UDP traffic and apply least-privilege network policy where business requirements allow.
- Maintain ownership and tagging discipline so suspicious workloads can be escalated and contained quickly.
- Prepare incident response playbooks for isolating a VM or container that generates suspicious UDP egress while preserving relevant flow log and cloud metadata evidence.
- Use findings from this analytic to inform cloud governance reviews, especially around unmanaged workloads, exposed egress paths, and logging gaps.
Analyst notes and limits
This object is an ATT&CK detection analytic, not a technique description. It provides a concise behavior statement but no official detection logic, tactics, relationships, aliases, or mitigation text. The most defensible use is as a validation prompt for IaaS network telemetry and cloud egress monitoring rather than as a complete detection rule.
The supplied fields do not identify adversary groups, active exploitation, specific amplifier ports, detection thresholds, affected cloud providers, or expected false-positive rates. Local environment baselines, approved UDP use cases, and cloud logging configuration are required to operationalize the analytic.
Analytic 1143
Cloud-hosted VM or container generates spoofed UDP requests to third-party services on known amplifier ports, with high outbound-to-inbound traffic ratios in VPC Flow Logs
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
All related ATT&CK context
No relationships are available in the current normalized data for this object.
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.0 | Current bundle | 9b98bd232810… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
mitre-attack AN1143Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.