tfMITRE ATT&CK sub-technique

Application Exhaustion Flood T1499.003

sub-technique of T1499 Endpoint Denial of Service

Tactic: Impact
Platforms: Windows, IaaS, Linux, macOS
Version: 1.3
Created: 20 February 2020
Last modified: 24 October 2025

Adversaries may target resource intensive features of applications to cause a denial of service (DoS), denying availability to those applications. For example, specific features in web applications may be highly resource intensive. Repeated requests to those features may be able to exhaust system resources and deny access to the application or the server itself.[1]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsNone recorded

Threat groupsNone recorded · 29% of ATT&CK techniques have none either.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malwareNone recorded

Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.

Detection rulesNone recorded

Detection rulesNone recorded · 33% of ATT&CK techniques have none either.

Offense vs defense T1499.003

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

Application Exhaustion Flood detection strategy DET0415

MITRE names one behaviour worth catching for this technique and breaks it into 4 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Application Exhaustion Flood Detection Across Platforms

Enterprise

4 platforms

AN1165 · Windows

Repeated invocation of high-resource application endpoints or GUI components causing CPU and memory spikes, logged as elevated request volumes, prolonged handle locks, or frequent crash recoveries.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Host StatusDC0018	Windows:perfmon	Sudden spikes in CPU/Memory usage linked to specific application processes
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
Application Log ContentDC0038	WinEventLog:Application	High-frequency errors or hangs from resource-intensive application components (e.g., .NET, IIS, Office Suite)

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
CPUThreshold	Define what percentage of CPU usage indicates abnormal behavior.
MemoryConsumptionWindow	Window (e.g., 5 mins) during which sustained memory usage may be abnormal.
AppCrashFrequency	Threshold for frequency of application faults within a specific interval.

AN1166 · Linux

Automated scripts or repeated CLI/API requests that trigger application backends to consume high CPU or memory (e.g., Apache/PHP, MySQL, mail servers), resulting in syslog errors and excessive process spawning.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	auditd:SYSCALL	execve
Application Log ContentDC0038	linux:syslog	Error/warning logs from services indicating load spike or worker exhaustion
Network Traffic ContentDC0085	NSM:Flow	Sustained abnormal inbound request rate targeting application ports (e.g., 80/443/25)

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
SyslogErrorRate	Defines number of critical errors in logs within time window.
PortRequestSpikeThreshold	Spike rate on monitored service port triggering alert.
ProcessSpawnRate	Rate of process creation that may overwhelm the system.

AN1167 · macOS

Repetitive triggering of GUI or backend application workflows that cause increased CPU/memory usage, logged in unified logs as spin reports or crash dumps.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	macos:osquery	Rapid spawning of resource-heavy applications (e.g., Preview, Safari, Office)
Application Log ContentDC0038	macos:unifiedlog	Application errors or resource contention from excessive frontend or script invocation

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
SpinReportCount	Threshold for number of system spin/crash reports in a defined window.
HeavyAppReopenRate	Frequency of user or script reopening GUI-heavy apps.

AN1168 · IaaS

Automated abuse of cloud-hosted applications (e.g., web apps, REST endpoints, internal APIs) causing compute exhaustion, high 5xx error rates, or frequent autoscaling triggers logged in app insights or cloudwatch.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Host StatusDC0018	AWS:CloudMetrics	Autoscaling, memory/cpu alarms, or instance unhealthiness
Application Log ContentDC0038	AWS:CloudWatch	Elevated 5xx response rates in application logs or gateway layer
Cloud Service MetadataDC0070	AWS:CloudTrail	InvokeFunction

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
HTTP5xxRateThreshold	Ratio of 5xx error codes over requests indicating resource exhaustion.
FunctionInvocationRate	Spike in lambda/API gateway executions indicating scripted behavior.
AutoscaleEventCount	Triggers linked to app DoS where legitimate scaling is mimicked.

Application Exhaustion Flood detections T1499.003

No detection rules are mapped to this technique yet.

None recorded— 33% of ATT&CK techniques have none either

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs