Application Exhaustion Flood
Where this stands
A reviewer read the telemetry and concluded there is nothing here to detect that a sibling technique does not already cover.
The distinguishing element of this sub-technique is repetition — the same legitimate, resource-intensive application feature invoked far more often than normal — and every analytic in the brief encodes it as a threshold over a window, which lib/sigma cannot express (no count aggregation, no near, no timeframe): CPUThreshold, MemoryConsumptionWindow and AppCrashFrequency (AN1165); SyslogErrorRate, PortRequestSpikeThreshold and ProcessSpawnRate (AN1166); SpinReportCount and HeavyAppReopenRate (AN1167). Removing the rate leaves nothing that discriminates, because the underlying request is by definition a supported feature of the application. The field problem is independent of the aggregation problem and is fatal on its own. […]
What the technique is
Adversaries may target resource intensive features of applications to cause a denial of service (DoS), denying availability to those applications. For example, specific features in web applications may be highly resource intensive. Repeated requests to those features may be able to exhaust system resources and deny access to the application or the server itself.
Read it on attack.mitre.orgWhat MITRE says you would watch
- AN1165
Repeated invocation of high-resource application endpoints or GUI components causing CPU and memory spikes, logged as elevated request volumes, prolonged handle locks, or frequent crash recoveries.
- AN1166
Automated scripts or repeated CLI/API requests that trigger application backends to consume high CPU or memory (e.g., Apache/PHP, MySQL, mail servers), resulting in syslog errors and excessive process spawning.
- AN1167
Repetitive triggering of GUI or backend application workflows that cause increased CPU/memory usage, logged in unified logs as spin reports or crash dumps.
Technique names and descriptions © MITRE ATT&CK®, CC BY 4.0. Not endorsed by MITRE.