tfMITRE ATT&CK sub-technique

Service Exhaustion Flood T1499.002

sub-technique of T1499 Endpoint Denial of Service

Tactic: Impact
Platforms: Windows, IaaS, Linux, macOS
Version: 1.4
Created: 20 February 2020
Last modified: 24 October 2025

Adversaries may target the different network services provided by systems to conduct a denial of service (DoS). Adversaries often target the availability of DNS and web services, however others have been targeted as well.[1] Web server software can be attacked through a variety of means, some of which apply generally while others are specific to the software being used to provide the service.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsNone recorded

Threat groupsNone recorded · 29% of ATT&CK techniques have none either.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malwareNone recorded

Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.

Detection rulesNone recorded

Detection rulesNone recorded · 33% of ATT&CK techniques have none either.

Offense vs defense T1499.002

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

Service Exhaustion Flood detection strategy DET0173

MITRE names one behaviour worth catching for this technique and breaks it into 4 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for Endpoint DoS via Service Exhaustion Flood

Enterprise

4 platforms

AN0489 · Windows

High-frequency, repetitive service requests (e.g., HTTP, TLS renegotiation) originating from a single or small set of source IPs targeting endpoint web services or application ports, leading to exhaustion of CPU or memory on targeted Windows services.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Host StatusDC0018	Windows:perfmon	Sustained CPU/memory exhaustion by service process (e.g., w3wp.exe)
Application Log ContentDC0038	WinEventLog:Application	Unexpected spikes in request volume, application-level errors, or thread pool exhaustion in web or API logs
Network Connection CreationDC0082	WinEventLog:Sysmon	EventCode=3, 22

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TimeWindow	Defines burst threshold (e.g., 1 min, 5 min) for connection spikes
TargetServicePort	Specific ports/services likely to be abused (e.g., 80, 443, 8080)
CPUThreshold	Level of sustained CPU usage considered anomalous for a given service

AN0490 · Linux

Excessive inbound HTTP or TLS connections to services such as Apache or Nginx, causing worker thread exhaustion or segmentation faults.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process AccessDC0035	auditd:SYSCALL	High frequency of accept(), read(), or SSL_read() syscalls tied to nginx/apache processes
Application Log ContentDC0038	linux:syslog	Repetitive HTTP 408, 500, or 503 errors logged within short timeframe
Network Traffic FlowDC0078	NSM:Flow	Sudden spike in incoming flows to web service ports from single/multiple IPs

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ErrorCodeWindow	Tunable count of specific HTTP error codes in timeframe
ConnectionRateThreshold	Defines number of connections per second considered anomalous

AN0491 · macOS

Flood of incoming TLS or HTTP(S) connections to macOS-hosted services (e.g., MAMP, Apache), causing high CPU usage and system unresponsiveness.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Host StatusDC0018	macos:unifiedlog	Web service process (e.g., httpd) entering crash loop or consuming excessive CPU
Network Traffic ContentDC0085	macos:unifiedlog	Rapid incoming TLS handshakes or HTTP requests in quick succession

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TLSHandshakeRate	Number of renegotiations per minute considered suspicious
ServiceCrashFrequency	Threshold of crashes before alerting on instability

AN0492 · IaaS

Automated or scripted HTTP/TLS flooding from one VM or cloud instance against another service, exploiting compute-based billing or exhaustion of service infrastructure.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Host StatusDC0018	AWS:CloudWatch	Sustained spike in CPU usage on EC2 instance with web service role
Firewall Rule ModificationDC0051	AWS:CloudTrail	AuthorizeSecurityGroupIngress
Network Traffic FlowDC0078	AWS:VPCFlowLogs	Unusual volume of inbound packets from single source across short time interval

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
VPCFlowBurstRate	Threshold for traffic burst on target service port
EC2CPUThreshold	Compute saturation level for alerting (e.g., >90% for 3 minutes)

Service Exhaustion Flood detections T1499.002

No detection rules are mapped to this technique yet.

None recorded— 33% of ATT&CK techniques have none either

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs