Techniques › T1499.004 › AN0853
AN0853 Analytic 0853
IaaS · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Cloud workload exploitation leads to repeated container, service, or VM termination/restart, typically associated with CVE-based crash triggers or fuzzed payloads.</p>
- Detects
- T1499.004 Application or System Exploitation
- Part of
- DET0304 Detection Strategy for Endpoint DoS via Application or System Exploitation
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| AWS:CloudTrail | TerminateInstances | DC0089 Instance Stop |
| AWS:CloudWatch | Repeated crash pattern within container or instance logs | DC0038 Application Log Content |
| AWS:VPCFlowLogs | Large volume of malformed or synthetic payloads to application endpoints prior to failure | DC0085 Network Traffic Content |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
CrashThreshold | Number of repeated crashes or terminations observed before triggering alert |
ServiceID | Cloud service name, workload, or container ID to scope alerting |
KEV CVEs whose mapped technique this analytic detects
| CVE | Vendor / product | State |
|---|---|---|
| CVE-2015-3043 | Adobe Flash Player | Mapped |
| CVE-2025-27363 | FreeType FreeType | Mapped |