tfMITRE ATT&CK technique

Endpoint Denial of Service T1499

Tactic: Impact
Platforms: Windows, Linux, macOS, Containers, IaaS
Version: 1.2
Created: 18 April 2019
Last modified: 24 October 2025
Contributors: Alfredo Oliveira, Trend Micro; David Fiser, @anu4is, Trend Micro; Magno Logan, @magnologan, Trend Micro; Vishwas Manral, McAfee; Yossi Weizman, Azure Defender Research Team

Sub-techniques 412 rules across the family · 8 mapped directly to T1499 · 2 of 4 carry rules

.001OS Exhaustion Flood1 .002Service Exhaustion Flood0 .003Application Exhaustion Flood0 .004Application or System Exploitation3

Adversaries may perform Endpoint Denial of Service (DoS) attacks to degrade or block the availability of services to users. Endpoint DoS can be performed by exhausting the system resources those services are hosted on or exploiting the system to cause a persistent crash condition. Example services include websites, email services, DNS, and web-based applications. Adversaries have been observed conducting DoS attacks for political purposes[1] and to support other malicious activities, including distraction[2], hacktivism, and extortion.[3]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups45th pct

Threat groups45th percentile · 55% of ATT&CK techniques have more threat groups attributed.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware51st pct

Tools & malware51st percentile · 51% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rules71st pct

Detection rules71st percentile · 71% of ATT&CK techniques have this many detection rules written or fewer.

Endpoint Denial of Service MITRE reference T1499

45th pctamong all ATT&CK techniques for number of groups

1 group has been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

Sandworm TeamG0034 ↗

Temporarily disrupted service to Georgian government, non-government, and private sector websites after compromising a Georgian web hosting provider in 2019.1

created 2017-05-311 referenceaka ELECTRUM

All 1 groups for this technique

Offense vs defense T1499

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 0Sigma rules (cumulative) · 4Splunk ESCU (cumulative) · 4

first rule: 2017 Q1

Endpoint Denial of Service detection strategy DET0208

MITRE names one behaviour worth catching for this technique and breaks it into 5 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Endpoint Resource Saturation and Crash Pattern Detection Across Platforms

Enterprise

5 platforms

AN0584 · Windows

Excessive resource exhaustion or service crash induced by processes launched by users or scripts that rapidly consume CPU/memory or attempt malformed service interactions.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Host StatusDC0018	WinEventLog:System	System shutdowns due to bugcheck (Event ID 1001) or watchdog timer expirations
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
Application Log ContentDC0038	WinEventLog:Application	Service crash, unhandled exception, or application hang warnings for critical services (e.g., IIS, DNS, SQL Server)

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TimeWindow	Number of service crashes or high-CPU events within a defined time period
ServiceTarget	Specific service name or executable targeted for DoS (e.g., svchost.exe, w3wp.exe)
CPUThresholdPercent	CPU usage percent considered anomalous over duration

AN0585 · Linux

Malicious script or binary causes repeated kernel panics, OOM kills, or systemd service restarts targeting services like nginx, httpd, sshd.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Host StatusDC0018	linux:syslog	Out of memory killer invoked or kernel panic entries
Process CreationDC0032	auditd:SYSCALL	execve
Application Log ContentDC0038	journald:systemd	Repeated service restart attempts or unit failures

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ServiceName	Targeted daemon/service such as sshd, nginx, mysql
RestartThreshold	Number of restarts in short succession to trigger alert
OOMKillCount	Count of OOM kills over a time window

AN0586 · macOS

Adversary launches high-entropy process or malformed app bundle causing repeated application crashes and system slowdowns.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Host StatusDC0018	macos:unifiedlog	Spike in CPU or memory use from non-user-initiated processes
Application Log ContentDC0038	macos:unifiedlog	Repeated process crashes logged by CrashReporter or system instability logs in com.apple.console

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
CrashCountThreshold	Number of app crashes within monitoring window
PayloadEntropyThreshold	Used for high-entropy binaries often observed in DoS malware samples

AN0587 · IaaS

Instance enters degraded/unhealthy state due to abnormal process load or memory exhaustion, often caused by automation or script-based attacks.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Host StatusDC0018	AWS:CloudWatch	StatusCheckFailed or StatusCheckFailed_System for burstable instances (t2/t3)
Network Traffic FlowDC0078	VPCFlowLogs:All	High volume internal traffic with low entropy indicating looped or malicious DoS script
Instance StartDC0080	AWS:CloudTrail	StartInstances

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
InstanceType	Burstable vs compute-optimized instances impact DoS effect
FailureThreshold	How many consecutive StatusCheckFailed events to consider critical

AN0588 · Containers

Container orchestrator logs show crashlooping pods, repeated resource exhaustion, or malicious binaries with infinite loops consuming systemd/cgroup limits.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Host StatusDC0018	kubernetes:events	CrashLoopBackOff, OOMKilled, container restart count exceeds threshold
Application Log ContentDC0038	docker:events	Container exited with non-zero code repeatedly in short period

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
RestartCountThreshold	Number of container restarts within a time window
ContainerImageEntropy	Payload entropy of container image as an anomaly factor

Endpoint Denial of Service detections T1499

8 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

71st pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs