Techniques › T1499 › T1499.002
T1499.002 Service Exhaustion Flood
impact — Windows, IaaS, Linux, macOS · attack.mitre.org · JSON
1
MITRE detection strategy
4
analytics
0
Sigma rules tagged attack.t1499.002
2
KEV CVEs mapped here
<p>Adversaries may target the different network services provided by systems to conduct a denial of service (DoS). Adversaries often target the availability of DNS and web services, however others have been targeted as well. Web server software can be attacked through a variety of means, some of which apply generally while others are specific to the software being used to provide the service.</p><p>One example of this type of attack is known as a simple HTTP flood, where an adversary sends a large number of HTTP requests to a web server to overwhelm it and/or an application that runs on top of it. This flood relies on raw volume to accomplish the objective, exhausting any of the various resources required by the victim software to provide the service.</p><p>Another variation, known as a SSL renegotiation attack, takes advantage of a protocol feature in SSL/TLS. The SSL/TLS protocol suite includes mechanisms for the client and server to agree on an encryption algorithm to use for subsequent secure connections. If SSL renegotiation is enabled, a request can be made for renegotiation of the crypto algorithm. In a renegotiation attack, the adversary establishes a SSL/TLS connection and then proceeds to make a series of renegotiation requests. Because the cryptographic renegotiation has a meaningful cost in computation cycles, this can cause an impact to the availability of the service when done in volume.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
| CVE | Vendor / product | Mapping type | State | Added |
|---|---|---|---|---|
| CVE-2022-26258 | D-Link DIR-820L | secondary impact | Mapped | 2022-09-08 |
| CVE-2021-45382 | D-Link Multiple Routers | secondary impact | Mapped | 2022-04-04 |
Detection strategy · ATT&CK Enterprise v19.2
- DET0173 Detection Strategy for Endpoint DoS via Service Exhaustion Flood v1.0
AN0489 WindowsHigh-frequency, repetitive service requests (e.g., HTTP, TLS renegotiation) originating from a single or small set of source IPs targeting endpoint web services or application ports, leading to exhaustion of CPU or memory on targeted Windows services.WinEventLog:Application
Unexpected spikes in request volume, application-level errors, or thread pool exhaustion in web or API logs→ DC0038 Application Log ContentWindows:perfmonSustained CPU/memory exhaustion by service process (e.g., w3wp.exe)→ DC0018 Host StatusTunable:TimeWindowTargetServicePortCPUThresholdAN0490 LinuxExcessive inbound HTTP or TLS connections to services such as Apache or Nginx, causing worker thread exhaustion or segmentation faults.auditd:SYSCALLHigh frequency of accept(), read(), or SSL_read() syscalls tied to nginx/apache processes→ DC0035 Process AccessNSM:FlowSudden spike in incoming flows to web service ports from single/multiple IPs→ DC0078 Network Traffic Flowlinux:syslogRepetitive HTTP 408, 500, or 503 errors logged within short timeframe→ DC0038 Application Log ContentTunable:ErrorCodeWindowConnectionRateThresholdAN0491 macOSFlood of incoming TLS or HTTP(S) connections to macOS-hosted services (e.g., MAMP, Apache), causing high CPU usage and system unresponsiveness.macos:unifiedlogWeb service process (e.g., httpd) entering crash loop or consuming excessive CPU→ DC0018 Host Statusmacos:unifiedlogRapid incoming TLS handshakes or HTTP requests in quick succession→ DC0085 Network Traffic ContentTunable:TLSHandshakeRateServiceCrashFrequencyAN0492 IaaSAutomated or scripted HTTP/TLS flooding from one VM or cloud instance against another service, exploiting compute-based billing or exhaustion of service infrastructure.AWS:VPCFlowLogsUnusual volume of inbound packets from single source across short time interval→ DC0078 Network Traffic FlowAWS:CloudWatchSustained spike in CPU usage on EC2 instance with web service role→ DC0018 Host StatusTunable:VPCFlowBurstRateEC2CPUThreshold
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1499.002
No Sigma rule carries this tag. MITRE publishes a detection strategy above, so the behaviour is specified; what is missing is public detection content. 2 actively exploited CVEs map here.
Rules tagged at the parent level (attack.t1499) 3
These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.
Author: Samuel Monsempes
· 2025-01-08 · logsource: product=windows service=application · 3f2c93c7-7b2a-4d58-bb8d-6f39422d8148
Detects exploitation attempt of CVE-2024-49113 known as LDAP Nightmare, based on "Application Error" log where the faulting application is "lsass.exe" and the faulting module is "WLDAP32.dll".
Author: Milad Cheraghi
· 2025-05-23 · logsource: product=linux service=auditd · ea61bb82-a5e0-42e6-8537-91d29500f1b9
Detects the potential abuse of the Linux Magic SysRq (System Request) key by adversaries with root or sufficient privileges
to silently manipulate or destabilize a system. By writing to /proc/sysrq-trigger, they can crash the system, kill processes,
or disrupt forensic analysis—all while bypassing standard logging. Though intended for recovery and debugging, SysRq can be
misused as a stealthy post-exploitation tool. It is controlled via /proc/sys/kernel/sysrq or permanently through /etc/sysctl.conf.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2026-06-02 · logsource: product=windows service=application · f8a66a02-4a16-46e5-b7fd-a42c8a93d137
Detects a crash of the LSASS process where netlogon.dll is the faulting module and the exception code is STATUS_STACK_BUFFER_OVERRUN (0xc0000409).
This crash, especially on Domain Controllers, might indicate the exploitation of CVE-2026-41089, a denial of service (DoS) vulnerability,
which exists in the Netlogon component of Windows and can be triggered by sending specially crafted requests to the Netlogon service,
leading to a stack-based buffer overflow and subsequent crash of the LSASS process.