T1499No distinct observable

Endpoint Denial of Service

ImpactWindows, Linux, macOS, Containers, IaaS

Where this stands

A reviewer read the telemetry and concluded there is nothing here to detect that a sibling technique does not already cover.

The technique is defined by quantities and rates that none of the brief's log sources records, and every mutable element in every analytic is a threshold over an aggregate: TimeWindow and CPUThresholdPercent (AN0584), RestartThreshold and OOMKillCount (AN0585), CrashCountThreshold and PayloadEntropyThreshold (AN0586). lib/sigma models no count aggregation, no timeframe and no near, so 'N crashes in M minutes' and 'CPU above X percent for a duration' cannot be written at all. The field problem is worse than the aggregation problem. AN0584's only log source is Sysmon EventID 1 (process_creation), which is a launch record — Image, CommandLine, ParentImage, User, IntegrityLevel — and carries no CPU, no memory and no handle count, so 'process rapidly consumes CPU/memory' has no field to select on; a launch record also cannot express 'induced a service crash', which is a downstream effect on a […]

Covered instead by T1499.001, T1499.002, T1499.003, T1499.004.

What the technique is

Adversaries may perform Endpoint Denial of Service (DoS) attacks to degrade or block the availability of services to users. Endpoint DoS can be performed by exhausting the system resources those services are hosted on or exploiting the system to cause a persistent crash condition. Example services include websites, email services, DNS, and web-based applications. Adversaries have been observed conducting DoS attacks for political purposes and to support other malicious activities, including distraction, hacktivism, and extortion. An Endpoint DoS denies the availability of a service without saturating the network used to provide access to the service. Adversaries can target various layers of the application stack that is hosted on the system used to provide the service. These layers include the Operating Systems (OS), server applications such as web servers, DNS servers, databases, and the (typically web-based) applications that sit on top of them. Attacking each layer requires different techniques that take advantage of bottlenecks that are unique to the respective components. A DoS attack may be generated by a single system or multiple systems spread across the internet, which is commonly referred to as a distributed DoS (DDoS). To perform DoS attacks against endpoint resources, several aspects apply to multiple methods, including IP address spoofing and botnets. […]

Read it on attack.mitre.org

What MITRE says you would watch

AN0584
Excessive resource exhaustion or service crash induced by processes launched by users or scripts that rapidly consume CPU/memory or attempt malformed service interactions.
AN0585
Malicious script or binary causes repeated kernel panics, OOM kills, or systemd service restarts targeting services like nginx, httpd, sshd.
AN0586
Adversary launches high-entropy process or malformed app bundle causing repeated application crashes and system slowdowns.