T1499.002 — Service Exhaustion Flood

Tactic: Impact · Platforms: Windows, IaaS, Linux, macOS

Adversaries may target the different network services provided by systems to conduct a denial of service (DoS). Adversaries often target the availability of DNS and web services, however others have been targeted as well. Web server software can be attacked through a variety of means, some of…

Sub-technique of Endpoint Denial of Service (T1499).

Sigma detection rules (4)

T1499.002 Endpoint Denial of Service: Service Exhaustion Flood

title: "T1499.002 Endpoint Denial of Service: Service Exhaustion Flood"
id: e9c9f2d0-8199-49b8-a9c8-665b18b7b360
description: 'Detects a high volume of outbound network connections from a single host to the same destination within a short time window, consistent with a compromised endpoint being used to generate an HTTP/DNS service exhaustion flood against a targeted service. (Data Component: Network Connection Creation; baseline tier: windows-eventid.) Tune using: TimeWindow, TargetServicePort, CPUThreshold.'
references:
  - https://attack.mitre.org/techniques/T1499/002
author: Shahrukh Khan
date: 2026-02-23
license: MIT
tags:
  - attack.impact
  - attack.t1499.002

logsource:
  category: network_connection
  product: windows
  service: sysmon

detection:
  selection:
    Initiated: 'true'
    DestinationPort:
      - 80
      - 443
      - 53
  timeframe: 1m
  condition: selection | count() by DestinationIp > 500

falsepositives:
  - Legitimate high-throughput applications, load-testing tools, or backup/sync clients generating many connections to the same destination in a short window.

level: medium

T1499.002 Endpoint Denial of Service: Service Exhaustion Flood

title: "T1499.002 Endpoint Denial of Service: Service Exhaustion Flood"
id: 9a30bb13-b2f5-45fe-9fd6-1f0b1ce1c50a
description: 'Detection Strategy for Endpoint DoS via Service Exhaustion Flood. The prior rule used an invalid logsource category (process_access is for inter-process access, not network syscalls) and watched local outbound connect() failures, which is semantically backwards: a victim service being flooded shows up as inbound accept() failures on the listening service, not the host own outbound connects failing. Retargeted to logsource category network_connection and to accept() syscalls failing specifically with EMFILE/ENFILE (file-descriptor/system-table exhaustion), which is a single-event-observable resource-exhaustion signal rather than an aggregate. Tune using: ErrorCodeWindow, ConnectionRateThreshold.'
references:
  - https://attack.mitre.org/techniques/T1499/002
author: Shahrukh Khan
date: 2026-06-07
license: MIT
tags:
  - attack.impact
  - attack.t1499.002

logsource:
  category: network_connection
  product: linux
  service: auditd

detection:
  selection:
    type: SYSCALL
    syscall: accept
    success: 'no'
    exit:
      - '-24'
      - '-23'

  condition: selection

falsepositives:
  - Services that are legitimately near their configured file-descriptor limits under heavy but expected legitimate load; ConnectionRateThreshold aggregation across many such failures in a short window helps distinguish an actual flood from occasional capacity tuning issues.

level: medium

T1499.002 Endpoint Denial of Service: Service Exhaustion Flood

title: "T1499.002 Endpoint Denial of Service: Service Exhaustion Flood"
id: 8ec04f88-97a2-4ae1-b985-8fe5526af1ef
description: 'Detection Strategy for Endpoint DoS via Service Exhaustion Flood. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: TLSHandshakeRate, ServiceCrashFrequency.'
references:
  - https://attack.mitre.org/techniques/T1499/002
author: Shahrukh Khan
date: 2026-06-13
license: MIT
tags:
  - attack.impact
  - attack.t1499.002

logsource:
  product: macos

detection:
  selection:
    Image|endswith:
      - '/sshd'
      - '/httpd'
  condition: selection

falsepositives:
  - Rising TLS handshake volume and service crash frequency capable of indicating service exhaustion are only meaningful as an aggregate rate over time, which single unified log events for sshd or httpd cannot express without an external rate-based correlation layer.

level: medium

T1499.002 Endpoint Denial of Service: Service Exhaustion Flood

title: "T1499.002 Endpoint Denial of Service: Service Exhaustion Flood"
id: ec8117ab-0cf4-40fc-853b-795ace4e4cfe
description: 'Detection Strategy for Endpoint DoS via Service Exhaustion Flood. (Retargeted to the cloudtrail AWS telemetry that actually captures this techniques behavior; see logsource below.) Tune using: VPCFlowBurstRate, EC2CPUThreshold.'
references:
  - https://attack.mitre.org/techniques/T1499/002
author: Shahrukh Khan
date: 2026-01-22
license: MIT
tags:
  - attack.impact
  - attack.t1499.002

logsource:
  category: cloudtrail
  product: aws

detection:
  selection:
    eventSource: 'ec2.amazonaws.com'
    eventName: 'AuthorizeSecurityGroupIngress'
    requestParameters.ipPermissions.items.ipRanges.items.cidrIp: '0.0.0.0/0'
    requestParameters.ipPermissions.items.ipProtocol: 'tcp'

  condition: selection

falsepositives:
  - Public-facing web tiers legitimately open ingress from 0.0.0.0/0 on ports 80 and 443, so scope to unusual ports or unexpected security groups before treating as an exhaustion-flood enabler.

level: medium

Related sub-techniques

Explore