tfMITRE ATT&CK sub-technique

OS Exhaustion Flood T1499.001

sub-technique of T1499 Endpoint Denial of Service

Tactic: Impact
Platforms: Linux, macOS, Windows
Version: 1.2
Created: 20 February 2020
Last modified: 24 October 2025

Adversaries may launch a denial of service (DoS) attack targeting an endpoint's operating system (OS). A system's OS is responsible for managing the finite resources as well as preventing the entire system from being overwhelmed by excessive demands on its capacity. These attacks do not need to exhaust the actual resources on a system; the attacks may simply exhaust the limits and available resources that an OS self-imposes.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsNone recorded

Threat groupsNone recorded · 29% of ATT&CK techniques have none either.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malwareNone recorded

Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.

Detection rules42nd pct

Detection rules42nd percentile · 58% of ATT&CK techniques have more detection rules written.

Offense vs defense T1499.001

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 0Sigma rules (cumulative) · 1Splunk ESCU (cumulative) · 0

first rule: 2021 Q1

OS Exhaustion Flood detection strategy DET0356

MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Endpoint DoS via OS Exhaustion Flood Detection Strategy

Enterprise

3 platforms

AN1012 · Windows

Burst of incomplete TCP handshakes (e.g., SYN floods) or uncorrelated ACK packets targeting the state table resulting in OS resource exhaustion.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Host StatusDC0018	WinEventLog:Microsoft-Windows-TCPIP	Connection queue overflow or failure to allocate TCP state object
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
Network Traffic ContentDC0085	NSM:Firewall	High rate of inbound TCP SYN or ACK packets with missing 3-way handshake completion

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TimeWindow	Threshold for burst traffic over short period (e.g., 30s - 2min)
ConnectionRateThreshold	SYN/ACK packet rate threshold that triggers investigation
ProcessParentCheck	Whether parent process of flooding tool is a known admin shell or unexpected context

AN1013 · Linux

Flood of spoofed SYN or ACK packets causing exhaustion of OS TCP state table, potentially via user-space utilities or kernel-level DoS agents.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Host StatusDC0018	NSM:Flow	TCP: possible SYN flood or backlog limit exceeded
Process CreationDC0032	auditd:SYSCALL	Invocation of packet generation tools (e.g., hping3, nping) or fork bombs
Network Traffic FlowDC0078	NSM:Flow	High volumes of SYN/ACK packets with unacknowledged TCP handshakes

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
AmplificationThreshold	Volume of fake TCP requests before OS begins degradation
Interface	Which network interface is being targeted or impacted

AN1014 · macOS

Adversary tool/script issuing mass SYN/ACK floods that degrade OS responsiveness and interrupt service response on macOS endpoints.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Host StatusDC0018	macos:unifiedlog	network stack resource exhaustion, tcp_accept queue overflow, repeated resets
Process CreationDC0032	macos:osquery	Execution of flooding tools or compiled packet generators
Network Traffic ContentDC0085	NSM:Firewall	Anomalous TCP SYN or ACK spikes from specific source or interface

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
SystemLoadThreshold	Observed CPU/network degradation level that triggers response
ToolExecutionPath	Where DoS tools are commonly dropped or compiled

OS Exhaustion Flood detections T1499.001

1 rule is mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

42nd pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs