Techniques › T1499 › T1499.004
T1499.004 Application or System Exploitation
impact — Windows, IaaS, Linux, macOS · attack.mitre.org · JSON
1
MITRE detection strategy
4
analytics
3
Sigma rules tagged attack.t1499.004
2
KEV CVEs mapped here
<p>Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users. Some systems may automatically restart critical applications and services when crashes occur, but they can likely be re-exploited to cause a persistent denial of service (DoS) condition.</p><p>Adversaries may exploit known or zero-day vulnerabilities to crash applications and/or systems, which may also lead to dependent applications and/or systems to be in a DoS condition. Crashed or restarted applications or systems may also have other effects such as Data Destruction, Firmware Corruption, Service Stop etc. which may further cause a DoS condition and deny availability to critical information, applications and/or systems.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
| CVE | Vendor / product | Mapping type | State | Added |
|---|---|---|---|---|
| CVE-2025-27363 | FreeType FreeType | secondary impact | Mapped | 2025-05-06 |
| CVE-2015-3043 | Adobe Flash Player | primary impact | Mapped | 2022-03-03 |
Detection strategy · ATT&CK Enterprise v19.2
- DET0304 Detection Strategy for Endpoint DoS via Application or System Exploitation v1.0
AN0850 WindowsExploitation of system or application vulnerability (e.g., CVE-based exploit) followed by service crash, restart, or repeated failure within a short time frame, impacting application/system availability.Tunable:
TimeWindowTargetApplicationAN0851 LinuxUser or remote input triggers application crash or segmentation fault (e.g., SIGSEGV) with service recovery attempts, observed via audit logs and systemd journaling.auditd:SYSCALLProcess segfault or abnormal termination after invoking vulnerable syscall sequence→ DC0033 Process Terminationjournald:ApplicationSegfault or crash log entry associated with specific application binary→ DC0038 Application Log ContentNSM:FlowUnusual request pattern leading up to service crash (e.g., malformed or oversized payload)→ DC0085 Network Traffic ContentTunable:CrashPatternExploitSourceIPAN0852 macOSApplication crash or repeated restart cycle triggered by malformed input or exploit file, observed via unified logs and process crash monitoring.macos:unifiedlogCrash log entries for a process receiving malformed input or known exploit patterns→ DC0038 Application Log Contentmacos:unifiedlogUnusual child process tree indicating attempted recovery after crash→ DC0032 Process CreationTunable:CrashSignatureInputVectorAN0853 IaaSCloud workload exploitation leads to repeated container, service, or VM termination/restart, typically associated with CVE-based crash triggers or fuzzed payloads.AWS:CloudWatchRepeated crash pattern within container or instance logs→ DC0038 Application Log ContentAWS:VPCFlowLogsLarge volume of malformed or synthetic payloads to application endpoints prior to failure→ DC0085 Network Traffic ContentTunable:CrashThresholdServiceID
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1499.004
Author: Florian Roth (Nextron Systems)
· 2017-02-28 (modified 2021-11-27) · logsource: service=apache · 1da8ce0b-855d-4004-8860-7d64d42063b1
Detects a segmentation fault error message caused by a crashing apache worker process
Author: Florian Roth (Nextron Systems), Zach Mathis
· 2020-01-15 (modified 2022-10-22) · logsource: product=windows service=application · 48d91a3a-2363-43ba-a456-ca71ac3da5c2
Detects events generated by user-mode applications when they call the CveEventWrite API when a known vulnerability is trying to be exploited.
MS started using this log in Jan. 2020 with CVE-2020-0601 (a Windows CryptoAPI vulnerability.
Unfortunately, that is about the only instance of CVEs being written to this log.
Author: Florian Roth (Nextron Systems)
· 2021-05-31 (modified 2023-05-08) · logsource: service=nginx · 59ec40bb-322e-40ab-808d-84fa690d7e56
Detects a core dump of a crashing Nginx worker process, which could be a signal of a serious problem or exploitation attempts.
Rules tagged at the parent level (attack.t1499) 3
These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.
Author: Samuel Monsempes
· 2025-01-08 · logsource: product=windows service=application · 3f2c93c7-7b2a-4d58-bb8d-6f39422d8148
Detects exploitation attempt of CVE-2024-49113 known as LDAP Nightmare, based on "Application Error" log where the faulting application is "lsass.exe" and the faulting module is "WLDAP32.dll".
Author: Milad Cheraghi
· 2025-05-23 · logsource: product=linux service=auditd · ea61bb82-a5e0-42e6-8537-91d29500f1b9
Detects the potential abuse of the Linux Magic SysRq (System Request) key by adversaries with root or sufficient privileges
to silently manipulate or destabilize a system. By writing to /proc/sysrq-trigger, they can crash the system, kill processes,
or disrupt forensic analysis—all while bypassing standard logging. Though intended for recovery and debugging, SysRq can be
misused as a stealthy post-exploitation tool. It is controlled via /proc/sys/kernel/sysrq or permanently through /etc/sysctl.conf.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2026-06-02 · logsource: product=windows service=application · f8a66a02-4a16-46e5-b7fd-a42c8a93d137
Detects a crash of the LSASS process where netlogon.dll is the faulting module and the exception code is STATUS_STACK_BUFFER_OVERRUN (0xc0000409).
This crash, especially on Domain Controllers, might indicate the exploitation of CVE-2026-41089, a denial of service (DoS) vulnerability,
which exists in the Netlogon component of Windows and can be triggered by sending specially crafted requests to the Netlogon service,
leading to a stack-based buffer overflow and subsequent crash of the LSASS process.