Techniques › T1499 › T1499.003
T1499.003 Application Exhaustion Flood
impact — Windows, IaaS, Linux, macOS · attack.mitre.org · JSON
1
MITRE detection strategy
4
analytics
0
Sigma rules tagged attack.t1499.003
0
KEV CVEs mapped here
<p>Adversaries may target resource intensive features of applications to cause a denial of service (DoS), denying availability to those applications. For example, specific features in web applications may be highly resource intensive. Repeated requests to those features may be able to exhaust system resources and deny access to the application or the server itself.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0415 Application Exhaustion Flood Detection Across Platforms v1.0
AN1165 WindowsRepeated invocation of high-resource application endpoints or GUI components causing CPU and memory spikes, logged as elevated request volumes, prolonged handle locks, or frequent crash recoveries.WinEventLog:Application
High-frequency errors or hangs from resource-intensive application components (e.g., .NET, IIS, Office Suite)→ DC0038 Application Log ContentWindows:perfmonSudden spikes in CPU/Memory usage linked to specific application processes→ DC0018 Host StatusTunable:CPUThresholdMemoryConsumptionWindowAppCrashFrequencyAN1166 LinuxAutomated scripts or repeated CLI/API requests that trigger application backends to consume high CPU or memory (e.g., Apache/PHP, MySQL, mail servers), resulting in syslog errors and excessive process spawning.linux:syslogError/warning logs from services indicating load spike or worker exhaustion→ DC0038 Application Log ContentNSM:FlowSustained abnormal inbound request rate targeting application ports (e.g., 80/443/25)→ DC0085 Network Traffic ContentTunable:SyslogErrorRatePortRequestSpikeThresholdProcessSpawnRateAN1167 macOSRepetitive triggering of GUI or backend application workflows that cause increased CPU/memory usage, logged in unified logs as spin reports or crash dumps.macos:unifiedlogApplication errors or resource contention from excessive frontend or script invocation→ DC0038 Application Log Contentmacos:osqueryRapid spawning of resource-heavy applications (e.g., Preview, Safari, Office)→ DC0032 Process CreationTunable:SpinReportCountHeavyAppReopenRateAN1168 IaaSAutomated abuse of cloud-hosted applications (e.g., web apps, REST endpoints, internal APIs) causing compute exhaustion, high 5xx error rates, or frequent autoscaling triggers logged in app insights or cloudwatch.AWS:CloudWatchElevated 5xx response rates in application logs or gateway layer→ DC0038 Application Log ContentTunable:HTTP5xxRateThresholdFunctionInvocationRateAutoscaleEventCount
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1499.003
No Sigma rule carries this tag. MITRE publishes a detection strategy above, so the behaviour is specified; what is missing is public detection content.
Rules tagged at the parent level (attack.t1499) 3
These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.
Author: Samuel Monsempes
· 2025-01-08 · logsource: product=windows service=application · 3f2c93c7-7b2a-4d58-bb8d-6f39422d8148
Detects exploitation attempt of CVE-2024-49113 known as LDAP Nightmare, based on "Application Error" log where the faulting application is "lsass.exe" and the faulting module is "WLDAP32.dll".
Author: Milad Cheraghi
· 2025-05-23 · logsource: product=linux service=auditd · ea61bb82-a5e0-42e6-8537-91d29500f1b9
Detects the potential abuse of the Linux Magic SysRq (System Request) key by adversaries with root or sufficient privileges
to silently manipulate or destabilize a system. By writing to /proc/sysrq-trigger, they can crash the system, kill processes,
or disrupt forensic analysis—all while bypassing standard logging. Though intended for recovery and debugging, SysRq can be
misused as a stealthy post-exploitation tool. It is controlled via /proc/sys/kernel/sysrq or permanently through /etc/sysctl.conf.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2026-06-02 · logsource: product=windows service=application · f8a66a02-4a16-46e5-b7fd-a42c8a93d137
Detects a crash of the LSASS process where netlogon.dll is the faulting module and the exception code is STATUS_STACK_BUFFER_OVERRUN (0xc0000409).
This crash, especially on Domain Controllers, might indicate the exploitation of CVE-2026-41089, a denial of service (DoS) vulnerability,
which exists in the Netlogon component of Windows and can be triggered by sending specially crafted requests to the Netlogon service,
leading to a stack-based buffer overflow and subsequent crash of the LSASS process.