IndustroyerS0604 ↗
Uses a custom DoS tool that leverages CVE-2015-5374 and targets hardcoded IP addresses of Siemens SIPROTEC devices.1
tfMITRE ATT&CK sub-technique
Application or System Exploitation T1499.004
sub-technique of T1499 Endpoint Denial of Service
- Tactic
- Impact
- Platforms
- Windows, IaaS, Linux, macOS
- Version
- 1.3
- Created
- 20 February 2020
- Last modified
- 24 October 2025
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users. [1] Some systems may automatically restart critical applications and services when crashes occur, but they can likely be re-exploited to cause a persistent denial of service (DoS) condition.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
0
Threat groupsNone recorded
Threat groupsNone recorded · 29% of ATT&CK techniques have none either.0
CampaignsNone recorded
CampaignsNone recorded · 54% of ATT&CK techniques have none either.1
Tools & malware44th pct
Tools & malware44th percentile · 56% of ATT&CK techniques have more tools implementing them.3
Detection rules54th pct
Detection rules54th percentile · 54% of ATT&CK techniques have this many detection rules written or fewer.Application or System Exploitation MITRE reference T1499.004
44th pctamong all ATT&CK techniques for number of tools
1 software entry is documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
All 1 software entries for this technique
Offense vs defense T1499.004
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 0Sigma rules (cumulative) · 3Splunk ESCU (cumulative) · 0
first rule: 2017 Q1Application or System Exploitation detection strategy DET0304
MITRE names one behaviour worth catching for this technique and breaks it into 4 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection Strategy for Endpoint DoS via Application or System Exploitation
4 platforms
AN0850 · Windows
Exploitation of system or application vulnerability (e.g., CVE-based exploit) followed by service crash, restart, or repeated failure within a short time frame, impacting application/system availability.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | WinEventLog:Sysmon | EventCode=1 |
| Application Log ContentDC0038 | WinEventLog:Application | EventCode=1000 |
| Service CreationDC0060 | WinEventLog:System | EventCode=7031, 7034 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TimeWindow | Time window between repeated service crashes or restarts (e.g., 5 crashes within 1 hour) |
| TargetApplication | Critical applications to monitor based on environment (e.g., web server, database, VPN) |
AN0851 · Linux
User or remote input triggers application crash or segmentation fault (e.g., SIGSEGV) with service recovery attempts, observed via audit logs and systemd journaling.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process TerminationDC0033 | auditd:SYSCALL | Process segfault or abnormal termination after invoking vulnerable syscall sequence |
| Application Log ContentDC0038 | journald:Application | Segfault or crash log entry associated with specific application binary |
| Network Traffic ContentDC0085 | NSM:Flow | Unusual request pattern leading up to service crash (e.g., malformed or oversized payload) |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| CrashPattern | Specific binary fault signature or stack trace identifiers unique to the application context |
| ExploitSourceIP | Suspect source IPs for correlation across requests and service failure timing |
AN0852 · macOS
Application crash or repeated restart cycle triggered by malformed input or exploit file, observed via unified logs and process crash monitoring.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | macos:unifiedlog | Unusual child process tree indicating attempted recovery after crash |
| Application Log ContentDC0038 | macos:unifiedlog | Crash log entries for a process receiving malformed input or known exploit patterns |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| CrashSignature | Binary crash hash or affected dylib for distinguishing malicious faults from benign ones |
| InputVector | File, IPC, or network-based input that may be triggering exploitation (e.g., PDF file, POST request) |
AN0853 · IaaS
Cloud workload exploitation leads to repeated container, service, or VM termination/restart, typically associated with CVE-based crash triggers or fuzzed payloads.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Application Log ContentDC0038 | AWS:CloudWatch | Repeated crash pattern within container or instance logs |
| Network Traffic ContentDC0085 | AWS:VPCFlowLogs | Large volume of malformed or synthetic payloads to application endpoints prior to failure |
| Instance StopDC0089 | AWS:CloudTrail | TerminateInstances |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| CrashThreshold | Number of repeated crashes or terminations observed before triggering alert |
| ServiceID | Cloud service name, workload, or container ID to scope alerting |
Leverage services provided by Content Delivery Networks (CDN) or providers specializing in DoS mitigations to filter traffic upstream from services. Filter boundary traffic by blocking source addresses sourcing the attack, blocking ports that are being targeted, or blocking protocols being used for transport.