1200KM / detection
T1499.001 OS Exhaustion Flood — Detection Rules
Detection workspace for T1499.001 OS Exhaustion Flood: 1 Sigma sources, 0 Atlas concepts and 0 anomaly models. No live detection validation.
Source-backed rule directory
- NTFS Vulnerability Exploitation · test · high · {"product":"windows","service":"system"}
Atlas deterministic concepts
No exact concept selected.
Anomaly models
No exact Atlas model in this snapshot.
ATT&CK analytic guidance
DET0356 Endpoint DoS via OS Exhaustion Flood Detection Strategy
AN1012 Analytic 1012
Burst of incomplete TCP handshakes (e.g., SYN floods) or uncorrelated ACK packets targeting the state table resulting in OS resource exhaustion.
AN1013 Analytic 1013
Flood of spoofed SYN or ACK packets causing exhaustion of OS TCP state table, potentially via user-space utilities or kernel-level DoS agents.
AN1014 Analytic 1014
Adversary tool/script issuing mass SYN/ACK floods that degrade OS responsiveness and interrupt service response on macOS endpoints.
Connected ecosystem references
Linked tags
Simulation, tools and telemetry
T1499.001 simulation workspace
- Host Status · DC0018
- Network Traffic Content · DC0085
- Network Traffic Flow · DC0078
- Process Creation · DC0032
No reviewed association in this snapshot.
Existing anomaly research
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.