T1499
Endpoint Denial of Service
Windows · Linux · macOS · Containers · IaaS1 piece on this siteT1499 on attack.mitre.org
Adversaries may perform Endpoint Denial of Service (DoS) attacks to degrade or block the availability of services to users. Endpoint DoS can be performed by exhausting the system resources those services are hosted on or exploiting the system to cause a persistent crash condition. Example services include websites, email services, DNS, and web-based applications.
If this is happening now
Checklists and playbooks to open while the alert is still live.
First-hour playbookMembers
A service is being denied
A public service is unreachable or degraded, and the traffic is not yours.
T1499
how MITRE says to see it
Endpoint Resource Saturation and Crash Pattern Detection Across Platforms
- Excessive resource exhaustion or service crash induced by processes launched by users or scripts that rapidly consume CPU/memory or attempt malformed service interactions.
- Malicious script or binary causes repeated kernel panics, OOM kills, or systemd service restarts targeting services like nginx, httpd, sshd.
- Adversary launches high-entropy process or malformed app bundle causing repeated application crashes and system slowdowns.
- Instance enters degraded/unhealthy state due to abnormal process load or memory exhaustion, often caused by automation or script-based attacks.
what reduces it
- M1037 Filter Network Traffic. Leverage services provided by Content Delivery Networks (CDN) or providers specializing in DoS mitigations to filter traffic upstream from services. Filter boundary traffic by blocking source addresses sourcing the attack, blocking ports that are being targeted, or blocking protocols being used for transport. To defend against SYN floods, enable SYN Cookies.