How to identify user sending syn tcp outgoing attack?

Hello, Is there any way to identify a users that is sending syn tcp outgoing attack? Cheers! Joao