T1499.001 — OS Exhaustion Flood

Tactic: Impact · Platforms: Linux, macOS, Windows

Adversaries may launch a denial of service (DoS) attack targeting an endpoint's operating system (OS). A system's OS is responsible for managing the finite resources as well as preventing the entire system from being overwhelmed by excessive demands on its capacity. These attacks do not need to…

Sub-technique of Endpoint Denial of Service (T1499).

Sigma detection rules (3)

T1499.001 Endpoint Denial of Service: OS Exhaustion Flood

title: "T1499.001 Endpoint Denial of Service: OS Exhaustion Flood"
id: bc345443-823d-48a6-b2fb-470dcac0049e
description: 'Endpoint DoS via OS Exhaustion Flood: detects an abnormally high volume of inbound (non-initiated) network connection attempts to a single endpoint port within a short window, a proxy for TCP state-exhaustion floods (e.g. SYN/ACK floods). Note: high-rate volumetric floods can overwhelm host-based Sysmon logging itself and are best detected at the network layer (NetFlow/IDS/firewall); this endpoint-side rule is a best-effort secondary signal, not a substitute for network-layer DoS detection. (Data Component: Network Connection Creation; baseline tier: windows-eventid.) Tune using: TimeWindow, ConnectionRateThreshold, ProcessParentCheck.'
references:
  - https://attack.mitre.org/techniques/T1499/001
author: Shahrukh Khan
date: 2026-03-16
license: MIT
tags:
  - attack.impact
  - attack.t1499.001

logsource:
  category: network_connection
  product: windows
  service: sysmon

detection:
  selection:
    EventID: 3
    Initiated: 'false'

  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection and not filter_system_account | count() by DestinationPort > 500

falsepositives:
  - Legitimate high-throughput services (web servers, load balancers) under heavy but legitimate load; System and service accounts (SYSTEM, LOCAL SERVICE, NETWORK SERVICE) performing the same action are excluded via filter_system_account; tune ConnectionRateThreshold per host role if noise remains.

level: medium

T1499.001 Endpoint Denial of Service: OS Exhaustion Flood

title: "T1499.001 Endpoint Denial of Service: OS Exhaustion Flood"
id: 71ac9f8c-6e6b-4f58-a627-66bd655537a0
description: 'Endpoint DoS via OS Exhaustion Flood Detection Strategy. (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: AmplificationThreshold, Interface.'
references:
  - https://attack.mitre.org/techniques/T1499/001
author: Shahrukh Khan
date: 2026-01-08
license: MIT
tags:
  - attack.impact
  - attack.t1499.001

logsource:
  category: process_creation
  product: linux

detection:
  selection:
    type: EXECVE
    a0|endswith:
      - '/hping3'
    a1|contains: '--flood'

  condition: selection

falsepositives:
  - Authorized load testing; AmplificationThreshold needs network-flow volume data auditd process telemetry cannot supply.

level: high

T1499.001 Endpoint Denial of Service: OS Exhaustion Flood

title: "T1499.001 Endpoint Denial of Service: OS Exhaustion Flood"
id: 9fd4dc7f-ebd2-47ca-93be-c840098c996d
description: 'Endpoint DoS via OS Exhaustion Flood Detection Strategy. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: SystemLoadThreshold, ToolExecutionPath.'
references:
  - https://attack.mitre.org/techniques/T1499/001
author: Shahrukh Khan
date: 2026-05-20
license: MIT
tags:
  - attack.impact
  - attack.t1499.001

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith:
      - '/yes'
      - '/dd'
      - '/python3'
  selection_args:
    CommandLine|contains:
      - '/dev/zero'
      - 'while True'
  condition: selection and selection_args

falsepositives:
  - Legitimate benchmarking and stress-testing scripts used by developers issue the same commands, so alerting should be reserved for unexpected sustained CPU or memory exhaustion outside a maintenance window.

level: high

Related sub-techniques

Explore