Techniques › T1499.002 › AN0489
AN0489 Analytic 0489
Windows · attack.mitre.org · ATT&CK Enterprise v19.2
<p>High-frequency, repetitive service requests (e.g., HTTP, TLS renegotiation) originating from a single or small set of source IPs targeting endpoint web services or application ports, leading to exhaustion of CPU or memory on targeted Windows services.</p>
- Detects
- T1499.002 Service Exhaustion Flood
- Part of
- DET0173 Detection Strategy for Endpoint DoS via Service Exhaustion Flood
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| WinEventLog:Application | Unexpected spikes in request volume, application-level errors, or thread pool exhaustion in web or API logs | DC0038 Application Log Content |
| WinEventLog:Sysmon | EventCode=3, 22 | DC0082 Network Connection Creation |
| Windows:perfmon | Sustained CPU/memory exhaustion by service process (e.g., w3wp.exe) | DC0018 Host Status |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
TimeWindow | Defines burst threshold (e.g., 1 min, 5 min) for connection spikes |
TargetServicePort | Specific ports/services likely to be abused (e.g., 80, 443, 8080) |
CPUThreshold | Level of sustained CPU usage considered anomalous for a given service |
KEV CVEs whose mapped technique this analytic detects
| CVE | Vendor / product | State |
|---|---|---|
| CVE-2021-45382 | D-Link Multiple Routers | Mapped |
| CVE-2022-26258 | D-Link DIR-820L | Mapped |