{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1499","id":"T1499","name":"Endpoint Denial of Service","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1499","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"d321a8176f5c367281bfd1325a3d0282dc3e53a107eae2867612e29ffaf05a63","description":"Adversaries may perform Endpoint Denial of Service (DoS) attacks to degrade or block the availability of services to users. Endpoint DoS can be performed by exhausting the system resources those services are hosted on or exploiting the system to cause a persistent crash condition. Example services include websites, email services, DNS, and web-based applications. Adversaries have been observed conducting DoS attacks for political purposes(Citation: FireEye OpPoisonedHandover February 2016) and to support other malicious activities, including distraction(Citation: FSISAC FraudNetDoS September 2012), hacktivism, and extortion.(Citation: Symantec DDoS October 2014)\n\nAn Endpoint DoS denies the availability of a service without saturating the network used to provide access to the service. Adversaries can target various layers of the application stack that is hosted on the system used to provide the service. These layers include the Operating Systems (OS), server applications such as web servers, DNS servers, databases, and the (typically web-based) applications that sit on top of them. Attacking each layer requires different techniques that take advantage of bottlenecks that are unique to the respective components. A DoS attack may be generated by a single system or multiple systems spread across the internet, which is commonly referred to as a distributed DoS (DDoS).\n\nTo perform DoS attacks against endpoint resources, several aspects apply to multiple methods, including IP address spoofing and botnets.\n\nAdversaries may use the original IP address of an attacking system, or spoof the source IP address to make the attack traffic more difficult to trace back to the attacking system or to enable reflection. This can increase the difficulty defenders have in defending against the attack by reducing or eliminating the effectiveness of filtering by the source address on network defense devices.\n\nBotnets are commonly used to conduct DDoS attacks against networks and services. Large botnets can generate a significant amount of traffic from systems spread across the global internet. Adversaries may have the resources to build out and control their own botnet infrastructure or may rent time on an existing botnet to conduct an attack. In some of the worst cases for DDoS, so many systems are used to generate requests that each one only needs to send out a small amount of traffic to produce enough volume to exhaust the target's resources. In such circumstances, distinguishing DDoS traffic from legitimate clients becomes exceedingly difficult. Botnets have been used in some of the most high-profile DDoS attacks, such as the 2012 series of incidents that targeted major US banks.(Citation: USNYAG IranianBotnet March 2016)\n\nIn cases where traffic manipulation is used, there may be points in the global network (such as high traffic gateway routers) where packets can be altered and cause legitimate clients to execute code that directs network packets toward a target in high volume. This type of capability was previously used for the purposes of web censorship where client HTTP traffic was modified to include a reference to JavaScript that generated the DDoS code to overwhelm target web servers.(Citation: ArsTechnica Great Firewall of China)\n\nFor attacks attempting to saturate the providing network, see [Network Denial of Service](https://attack.mitre.org/techniques/T1498).\n","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1499","external_id":"T1499"},{"source_name":"Cisco DoSdetectNetflow","description":"Cisco. (n.d.). Detecting and Analyzing Network Threats With NetFlow. Retrieved April 25, 2019.","url":"https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/netflow/configuration/15-mt/nf-15-mt-book/nf-detct-analy-thrts.pdf"},{"source_name":"FSISAC FraudNetDoS September 2012","description":"FS-ISAC. (2012, September 17). Fraud Alert – Cyber Criminals Targeting Financial Institution Employee Credentials to Conduct Wire Transfer Fraud. Retrieved September 23, 2024.","url":"https://www.ic3.gov/Media/PDF/Y2012/FraudAlertFinancialInstitutionEmployeeCredentialsTargeted.pdf"},{"source_name":"ArsTechnica Great Firewall of China","description":"Goodin, D.. (2015, March 31). Massive denial-of-service attack on GitHub tied to Chinese government. Retrieved April 19, 2019.","url":"https://arstechnica.com/information-technology/2015/03/massive-denial-of-service-attack-on-github-tied-to-chinese-government/"},{"source_name":"FireEye OpPoisonedHandover February 2016","description":"Ned Moran, Mike Scott, Mike Oppenheim of FireEye. (2014, November 3). Operation Poisoned Handover: Unveiling Ties Between APT Activity in Hong Kong’s Pro-Democracy Movement. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20201127180357/https://www.fireeye.com/blog/threat-research/2014/11/operation-poisoned-handover-unveiling-ties-between-apt-activity-in-hong-kongs-pro-democracy-movement.html"},{"source_name":"USNYAG IranianBotnet March 2016","description":"Preet Bharara, US Attorney. (2016, March 24). Retrieved April 23, 2019.","url":"https://www.justice.gov/opa/pr/seven-iranians-working-islamic-revolutionary-guard-corps-affiliated-entities-charged"},{"source_name":"Symantec DDoS October 2014","description":"Wueest, C.. (2014, October 21). The continued rise of DDoS attacks. Retrieved April 24, 2019.","url":"https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/the-continued-rise-of-ddos-attacks.pdf"}],"platforms":["Windows","Linux","macOS","Containers","IaaS"],"environments":["cloud","cloud-hosted-endpoint","containers","onprem"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[{"key":"enterprise/T1499.001","id":"T1499.001","name":"OS Exhaustion Flood","page":"techniques/enterprise/T1499.001/"},{"key":"enterprise/T1499.002","id":"T1499.002","name":"Service Exhaustion Flood","page":"techniques/enterprise/T1499.002/"},{"key":"enterprise/T1499.003","id":"T1499.003","name":"Application Exhaustion Flood","page":"techniques/enterprise/T1499.003/"},{"key":"enterprise/T1499.004","id":"T1499.004","name":"Application or System Exploitation","page":"techniques/enterprise/T1499.004/"}],"telemetry":[{"id":"DC0038","name":"Application Log Content","page":"telemetry/DC0038/","kind":"attack_component","category":"Application and service audit","description":"Application-emitted audit or operational event content.","collection_focus":"Select the application event family required by the detection and document its native schema before normalization.","providers":[{"name":"Application audit logs","scope":"First-party service events and request/result fields; schema is application-specific.","source_id":"otel"},{"name":"OpenTelemetry-compatible log pipelines","scope":"Transport and normalization of emitted records; do not create missing audit instrumentation.","source_id":"otel"}],"configuration":["Enable the application audit category or instrument the owned lab application at the authorization/action boundary.","Define a schema with timestamp, service, actor, object, action, result and correlation ID. Export structured records through an authenticated collector.","Redact secrets and personal content, separate audit from debug logs, set retention and verify delivery during rotation/restart."],"configuration_example":null,"required_fields":["service","action","actor","record_count","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0038","collector":"illustrative-lab-collector","observation":{"service":"lab-portal","action":"export_requested","actor":"lab-reader","record_count":3,"result":"authorized"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Debug output is not necessarily a durable audit trail. Application developers must emit the relevant event; installing a log pipeline does not make an absent event exist.","sources":[{"id":"otel","title":"OpenTelemetry log data model","url":"https://opentelemetry.io/docs/specs/otel/logs/data-model/"}],"association":"attack_component","anomaly_design":"Per application, client and route: request rate, rare actions, failure ratios and unusual state transitions. Version changes, retries, health probes and seasonal load need separate baselines."},{"id":"DC0018","name":"Host Status","page":"telemetry/DC0018/","kind":"attack_component","category":"Host state and inventory","description":"Host health and availability observations such as heartbeat, shutdown or degraded state.","collection_focus":"Collect agent heartbeat and OS health independently; record missed polls, last-seen time and monitor health.","providers":[{"name":"osquery","scope":"Scheduled host-state queries; supported tables and privileges vary by OS. Select a table that actually exposes the required object.","source_id":"osquery"},{"name":"Linux Audit plus inventory snapshots","scope":"Events explain changes; snapshots describe state at collection time.","source_id":"linux"}],"configuration":["Define the inventory query, allowed host set, interval and least-privileged reader. Store a stable asset ID, observation time and collector version.","Keep successive snapshots and calculate additions, removals and changed attributes. Pair state changes with audit events when available.","Export collector health and missed-poll counts so a missing snapshot is not misclassified as a missing asset."],"configuration_example":null,"required_fields":["asset_id","status","heartbeat_age_seconds","collector_healthy"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0018","collector":"illustrative-lab-collector","observation":{"asset_id":"lab-host-1","status":"degraded","heartbeat_age_seconds":90,"collector_healthy":true}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Snapshots miss short-lived objects and do not identify who caused a change. A generic inventory agent is not guaranteed to expose firmware or kernel-level details.","sources":[{"id":"osquery","title":"osquery scheduled configuration","url":"https://github.com/osquery/osquery/blob/master/docs/wiki/deployment/configuration.md"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Compare authorized state snapshots: first-seen drivers/services/modules, unexpected configuration drift and integrity changes. Record collection cadence; absence in a sample is not evidence of deletion."},{"id":"DC0080","name":"Instance Start","page":"telemetry/DC0080/","kind":"attack_component","category":"Cloud control plane","description":"A request to start a stopped compute instance and its resulting state.","collection_focus":"Collect start APIs and instance-state transitions with request IDs; distinguish accepted from completed.","providers":[{"name":"AWS CloudTrail","scope":"Management-plane API activity; supported resource/data events require separate selectors.","source_id":"cloudtrail"},{"name":"Azure Monitor Activity Log","scope":"Azure resource control-plane operations; resource data-plane logs are separate.","source_id":"azure"},{"name":"Google Cloud Audit Logs","scope":"Admin Activity and other categories; configure Data Access where required.","source_id":"gcp"}],"configuration":["In the isolated account/project/subscription, route administrative audit logs to a protected destination with retention and access controls.","Select the relevant service, regions and read/write operations. Confirm whether the API below is a management or data event in the provider documentation.","Preserve actor/session, resource, request ID, service, operation, region and error details. Check delivery latency and avoid logging credentials or sensitive request bodies."],"configuration_example":null,"required_fields":["instance_id","action","state_before","state_after"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0080","collector":"illustrative-lab-collector","observation":{"instance_id":"vm-lab-1","action":"start","state_before":"stopped","state_after":"pending"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"AWS, Azure and Google expose different APIs and event schemas. An accepted API request does not prove the final resource state; join asynchronous outcomes and inventory.","sources":[{"id":"cloudtrail","title":"AWS CloudTrail event categories","url":"https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-events.html"},{"id":"ec2","title":"AWS EC2 API logging with CloudTrail","url":"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/monitor-with-cloudtrail.html"},{"id":"azure","title":"Azure Monitor Activity Log","url":"https://learn.microsoft.com/en-us/azure/azure-monitor/fundamentals/activity-log"},{"id":"gcp","title":"Google Cloud Audit Logs","url":"https://docs.cloud.google.com/logging/docs/audit"}],"association":"attack_component","anomaly_design":"Per account, role, region and API: rare actions, new role-resource relationships, enumeration bursts and configuration changes. Separate deployment automation and organization-level administrative activity."},{"id":"DC0078","name":"Network Traffic Flow","page":"telemetry/DC0078/","kind":"attack_component","category":"Network and protocol telemetry","description":"Connection/flow summaries such as endpoints, duration, byte counts and transport.","collection_focus":"Collect Zeek conn.log, Suricata flow events or exporter equivalents, including observation point and sampling settings.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"},{"name":"AWS VPC Flow Logs","scope":"IP traffic metadata alternative; no packet payload or DNS answer history, and some traffic is not logged.","source_id":"flow"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["source_ip","destination_ip","destination_port","protocol","bytes_sent","bytes_received"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0078","collector":"illustrative-lab-collector","observation":{"source_ip":"192.0.2.10","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","bytes_sent":128,"bytes_received":512}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"},{"id":"flow","title":"AWS VPC Flow Logs","url":"https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html"}],"association":"attack_component","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."},{"id":"DC0032","name":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component","category":"Endpoint activity","description":"Creation of a process with executable, command line, parent and security context.","collection_focus":"Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":{"label":"Sysmon filter fragment · merge into the reviewed lab configuration","language":"xml","source_id":"sysmon_config","content":"<EventFiltering>\n  <ProcessCreate onmatch=\"include\">\n    <Image condition=\"is\">C:\\Windows\\System32\\whoami.exe</Image>\n  </ProcessCreate>\n</EventFiltering>","note":"This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>."},"required_fields":["process_guid","image","parent_image","command_line","user"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."}],"detection":{"key":"enterprise/T1499","id":"T1499","name":"Endpoint Denial of Service","domain":"enterprise","platforms":["Windows","Linux","macOS","Containers","IaaS"],"environments":["cloud","cloud-hosted-endpoint","containers","onprem"],"source_url":"https://attack.mitre.org/techniques/T1499","technique_page":"techniques/enterprise/T1499/","page":"detections/enterprise/T1499/","status":"rule_source_available","counts":{"sigma":1,"atlas_basic":1,"atlas_anomaly":1,"strategies":1,"analytics":5,"live_validated":0},"sigma_rules":[{"id":"ea61bb82-a5e0-42e6-8537-91d29500f1b9","title":"Potential Abuse of Linux Magic System Request Key","status":"experimental","level":"medium","logsource":{"product":"linux","service":"auditd","definition":"Required auditd configuration:\n-w /proc/sysrq-trigger -p wa -k sysrq\n-w /proc/sys/kernel/sysrq -p wa -k sysrq\n"},"data_path":"data/detection-rules/ea61bb82-a5e0-42e6-8537-91d29500f1b9.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/auditd/path/lnx_auditd_magic_system_request_key.yml","author":"Milad Cheraghi","kind":"sigma"}],"atlas_basic":[{"id":"atlas-basic-t1499-1","technique_id":"T1499","title":"T1499 Endpoint Denial of Service","kind":"basic","source_url":"https://1200km.com/anomaly-detection-atlas/attack-basic-detection-rule-catalog/#impact","source_path":"docs/attack-basic-detection-rule-catalog.md","source_line":192,"pinned_source_url":"https://github.com/anpa1200/anomaly-detection-atlas/blob/e1f75007376022b2f596e413bea8612e514a5aa3/docs/attack-basic-detection-rule-catalog.md#L192","source_file_sha256":"396a87e3d8da74d170684c0f377fe5dc11cd1a486d4f2f89f7fbe94deaaa2a1e","source_row_sha256":"7d5fcfad9ddcd5620f410300e57950b05ef595ca4872842cddab1e134539193d","validation":"published_concept_not_executable_or_live_validated","logic":"COUNT(request_or_connection BY source, 1m) >= threshold AND service_error_or_unavailable = true -> ALERT","log_sources":[{"title":"Network Firewall Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#52-network-firewall-logs"},{"title":"Web Server Access Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#79-web-server-access-logs"},{"title":"Metrics and Monitoring-System Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#152-metrics-and-monitoring-system-logs"}]}],"atlas_anomaly":[{"id":"atlas-anomaly-t1499-1","technique_id":"T1499","title":"Service or system availability disrupted — T1499 Endpoint Denial of Service","kind":"anomaly","source_url":"https://1200km.com/anomaly-detection-atlas/attack-statistical-anomaly-mapping/#service-disruption","source_path":"docs/attack-statistical-anomaly-mapping.md","source_line":120,"pinned_source_url":"https://github.com/anpa1200/anomaly-detection-atlas/blob/e1f75007376022b2f596e413bea8612e514a5aa3/docs/attack-statistical-anomaly-mapping.md#L120","source_file_sha256":"9d38eaa6306863918e8193f267fb063270260e50b013928dc97893d5e74bf144","source_row_sha256":"6d8fed2615be471aa650c65ba1a5039996a6de56e8cf0192524425c4241d44c5","validation":"published_concept_not_executable_or_live_validated","comparison_unit":"service metrics and request stream.","expected_behavior":"request rate, latency, error ratio, and availability stay within operating ranges.","deviation":"rate tail event, abrupt level shift, and synchronized error increase.","anomaly_types":[{"title":"Rate Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#14-rate-anomaly"},{"title":"Level-Shift Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#23-level-shift-anomaly"},{"title":"Synchronization Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#33-synchronization-anomaly"}],"log_sources":[{"title":"Metrics and Monitoring-System Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#152-metrics-and-monitoring-system-logs"},{"title":"Application Runtime Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#82-application-runtime-logs"}],"context_references":[{"title":"F5 Labs 2024 DDoS Attack Trends — downloaded copy","url":"https://1200km.com/anomaly-detection-atlas/reports/cti-ir/f5-2024-ddos-attack-trends.html"},{"title":"original source","url":"https://www.f5.com/fr_fr/labs/articles/threat-intelligence/2024-ddos-attack-trends"}]}],"anomaly_types":[{"title":"Level-Shift Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#23-level-shift-anomaly"},{"title":"Rate Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#14-rate-anomaly"},{"title":"Synchronization Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#33-synchronization-anomaly"}],"strategies":[{"id":"DET0208","name":"Endpoint Resource Saturation and Crash Pattern Detection Across Platforms","url":"https://attack.mitre.org/detectionstrategies/DET0208","stix_id":"x-mitre-detection-strategy--253b632e-c4cb-4207-9b6a-58a35a07d2ea","relationship_id":"relationship--cbf233dc-3732-45d3-b89a-b7df7dc1d2ff","description":"","analytics":[{"id":"AN0584","name":"Analytic 0584","guidance":"Excessive resource exhaustion or service crash induced by processes launched by users or scripts that rapidly consume CPU/memory or attempt malformed service interactions.","url":"https://attack.mitre.org/detectionstrategies/DET0208#AN0584","platforms":["Windows"],"tuning":[{"field":"TimeWindow","description":"Number of service crashes or high-CPU events within a defined time period"},{"field":"ServiceTarget","description":"Specific service name or executable targeted for DoS (e.g., svchost.exe, w3wp.exe)"},{"field":"CPUThresholdPercent","description":"CPU usage percent considered anomalous over duration"}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"WinEventLog:Sysmon","channel":"EventCode=1","platforms":["Windows"],"analytic_id":"AN0584","source_url":"https://attack.mitre.org/detectionstrategies/DET0208#AN0584","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0038","component":"Application Log Content","name":"WinEventLog:Application","channel":"Service crash, unhandled exception, or application hang warnings for critical services (e.g., IIS, DNS, SQL Server)","platforms":["Windows"],"analytic_id":"AN0584","source_url":"https://attack.mitre.org/detectionstrategies/DET0208#AN0584","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0038/"},{"component_id":"DC0018","component":"Host Status","name":"WinEventLog:System","channel":"System shutdowns due to bugcheck (Event ID 1001) or watchdog timer expirations","platforms":["Windows"],"analytic_id":"AN0584","source_url":"https://attack.mitre.org/detectionstrategies/DET0208#AN0584","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0018/"}]},{"id":"AN0585","name":"Analytic 0585","guidance":"Malicious script or binary causes repeated kernel panics, OOM kills, or systemd service restarts targeting services like nginx, httpd, sshd.","url":"https://attack.mitre.org/detectionstrategies/DET0208#AN0585","platforms":["Linux"],"tuning":[{"field":"ServiceName","description":"Targeted daemon/service such as sshd, nginx, mysql"},{"field":"RestartThreshold","description":"Number of restarts in short succession to trigger alert"},{"field":"OOMKillCount","description":"Count of OOM kills over a time window"}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"auditd:SYSCALL","channel":"execve","platforms":["Linux"],"analytic_id":"AN0585","source_url":"https://attack.mitre.org/detectionstrategies/DET0208#AN0585","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0018","component":"Host Status","name":"linux:syslog","channel":"Out of memory killer invoked or kernel panic entries","platforms":["Linux"],"analytic_id":"AN0585","source_url":"https://attack.mitre.org/detectionstrategies/DET0208#AN0585","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0018/"},{"component_id":"DC0038","component":"Application Log Content","name":"journald:systemd","channel":"Repeated service restart attempts or unit failures","platforms":["Linux"],"analytic_id":"AN0585","source_url":"https://attack.mitre.org/detectionstrategies/DET0208#AN0585","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0038/"}]},{"id":"AN0586","name":"Analytic 0586","guidance":"Adversary launches high-entropy process or malformed app bundle causing repeated application crashes and system slowdowns.","url":"https://attack.mitre.org/detectionstrategies/DET0208#AN0586","platforms":["macOS"],"tuning":[{"field":"CrashCountThreshold","description":"Number of app crashes within monitoring window"},{"field":"PayloadEntropyThreshold","description":"Used for high-entropy binaries often observed in DoS malware samples"}],"log_sources":[{"component_id":"DC0038","component":"Application Log Content","name":"macos:unifiedlog","channel":"Repeated process crashes logged by CrashReporter or system instability logs in com.apple.console","platforms":["macOS"],"analytic_id":"AN0586","source_url":"https://attack.mitre.org/detectionstrategies/DET0208#AN0586","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0038/"},{"component_id":"DC0018","component":"Host Status","name":"macos:unifiedlog","channel":"Spike in CPU or memory use from non-user-initiated processes","platforms":["macOS"],"analytic_id":"AN0586","source_url":"https://attack.mitre.org/detectionstrategies/DET0208#AN0586","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0018/"}]},{"id":"AN0587","name":"Analytic 0587","guidance":"Instance enters degraded/unhealthy state due to abnormal process load or memory exhaustion, often caused by automation or script-based attacks.","url":"https://attack.mitre.org/detectionstrategies/DET0208#AN0587","platforms":["IaaS"],"tuning":[{"field":"InstanceType","description":"Burstable vs compute-optimized instances impact DoS effect"},{"field":"FailureThreshold","description":"How many consecutive StatusCheckFailed events to consider critical"}],"log_sources":[{"component_id":"DC0018","component":"Host Status","name":"AWS:CloudWatch","channel":"StatusCheckFailed or StatusCheckFailed_System for burstable instances (t2/t3)","platforms":["IaaS"],"analytic_id":"AN0587","source_url":"https://attack.mitre.org/detectionstrategies/DET0208#AN0587","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0018/"},{"component_id":"DC0080","component":"Instance Start","name":"AWS:CloudTrail","channel":"StartInstances","platforms":["IaaS"],"analytic_id":"AN0587","source_url":"https://attack.mitre.org/detectionstrategies/DET0208#AN0587","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0080/"},{"component_id":"DC0078","component":"Network Traffic Flow","name":"VPCFlowLogs:All","channel":"High volume internal traffic with low entropy indicating looped or malicious DoS script","platforms":["IaaS"],"analytic_id":"AN0587","source_url":"https://attack.mitre.org/detectionstrategies/DET0208#AN0587","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0078/"}]},{"id":"AN0588","name":"Analytic 0588","guidance":"Container orchestrator logs show crashlooping pods, repeated resource exhaustion, or malicious binaries with infinite loops consuming systemd/cgroup limits.","url":"https://attack.mitre.org/detectionstrategies/DET0208#AN0588","platforms":["Containers"],"tuning":[{"field":"RestartCountThreshold","description":"Number of container restarts within a time window"},{"field":"ContainerImageEntropy","description":"Payload entropy of container image as an anomaly factor"}],"log_sources":[{"component_id":"DC0018","component":"Host Status","name":"kubernetes:events","channel":"CrashLoopBackOff, OOMKilled, container restart count exceeds threshold","platforms":["Containers"],"analytic_id":"AN0588","source_url":"https://attack.mitre.org/detectionstrategies/DET0208#AN0588","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0018/"},{"component_id":"DC0038","component":"Application Log Content","name":"docker:events","channel":"Container exited with non-zero code repeatedly in short period","platforms":["Containers"],"analytic_id":"AN0588","source_url":"https://attack.mitre.org/detectionstrategies/DET0208#AN0588","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0038/"}]}]}],"telemetry_references":[{"id":"DC0038","name":"Application Log Content","tag":"Application Log Content","page":"telemetry/DC0038/","kind":"attack_component"},{"id":"DC0018","name":"Host Status","tag":"Host Status","page":"telemetry/DC0018/","kind":"attack_component"},{"id":"DC0080","name":"Instance Start","tag":"Instance Start","page":"telemetry/DC0080/","kind":"attack_component"},{"id":"DC0078","name":"Network Traffic Flow","tag":"Network Traffic Flow","page":"telemetry/DC0078/","kind":"attack_component"},{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[{"id":"S0052","name":"OnionDuke","url":"https://attack.mitre.org/software/S0052","kind":"malware","description":"[OnionDuke](https://attack.mitre.org/software/S0052) has the capability to use a Denial of Service module.(Citation: ESET Dukes October 2019)","relationship_id":"relationship--5e5b108b-fec6-4d44-ad9a-9302d4f6e368","references":[{"source_name":"ESET Dukes October 2019","description":"Faou, M., Tartare, M., Dupuy, T. (2019, October). OPERATION GHOST. Retrieved September 23, 2020.","url":"https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Operation_Ghost_Dukes.pdf"}]},{"id":"S0412","name":"ZxShell","url":"https://attack.mitre.org/software/S0412","kind":"malware","description":"[ZxShell](https://attack.mitre.org/software/S0412) has a feature to perform SYN flood attack on a host.(Citation: FireEye APT41 Aug 2019)(Citation: Talos ZxShell Oct 2014) ","relationship_id":"relationship--dda297c6-2edc-47c5-b32b-0d4ef0f85be4","references":[{"source_name":"Talos ZxShell Oct 2014","description":"Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019.","url":"https://blogs.cisco.com/security/talos/opening-zxshell"},{"source_name":"FireEye APT41 Aug 2019","description":"Fraser, N., et al. (2019, August 7). Double DragonAPT41, a dual espionage and cyber crime operation APT41. Retrieved September 23, 2019.","url":"https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf"}]}],"actors":[{"id":"G0034","name":"Sandworm Team","url":"https://attack.mitre.org/groups/G0034","kind":"intrusion-set","description":"[Sandworm Team](https://attack.mitre.org/groups/G0034) temporarily disrupted service to Georgian government, non-government, and private sector websites after compromising a Georgian web hosting provider in 2019.(Citation: US District Court Indictment GRU Unit 74455 October 2020)","relationship_id":"relationship--927272db-cc41-45ce-bb38-e3e37ac3a68e","references":[{"source_name":"US District Court Indictment GRU Unit 74455 October 2020","description":"Scott W. Brady. (2020, October 15). United States vs. Yuriy Sergeyevich Andrienko et al.. Retrieved November 25, 2020.","url":"https://www.justice.gov/opa/press-release/file/1328521/download"}]}],"mitigations":[{"id":"M1037","name":"Filter Network Traffic","url":"https://attack.mitre.org/mitigations/M1037","kind":"course-of-action","description":"Leverage services provided by Content Delivery Networks (CDN) or providers specializing in DoS mitigations to filter traffic upstream from services.(Citation: CERT-EU DDoS March 2017) Filter boundary traffic by blocking source addresses sourcing the attack, blocking ports that are being targeted, or blocking protocols being used for transport. To defend against SYN floods, enable SYN Cookies.","relationship_id":"relationship--5d37f644-31c5-414e-9a83-cb6fb36b87e0","references":[{"source_name":"CERT-EU DDoS March 2017","description":"Meintanis, S., Revuelto, V., Socha, K.. (2017, March 10). DDoS Overview and Response Guide. Retrieved April 24, 2019.","url":"http://cert.europa.eu/static/WhitePapers/CERT-EU_Security_Whitepaper_DDoS_17-003.pdf"}]}],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1498":"/ttp-simulation/techniques/enterprise/T1498/","T1499":"/ttp-simulation/techniques/enterprise/T1499/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1499","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0038","collector":"illustrative-lab-collector","observation":{"service":"lab-portal","action":"export_requested","actor":"lab-reader","record_count":3,"result":"authorized"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0018","collector":"illustrative-lab-collector","observation":{"asset_id":"lab-host-1","status":"degraded","heartbeat_age_seconds":90,"collector_healthy":true}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0080","collector":"illustrative-lab-collector","observation":{"instance_id":"vm-lab-1","action":"start","state_before":"stopped","state_after":"pending"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0078","collector":"illustrative-lab-collector","observation":{"source_ip":"192.0.2.10","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","bytes_sent":128,"bytes_received":512}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}}]}}