T1499.004 — Application or System Exploitation

Tactic: Impact · Platforms: Windows, IaaS, Linux, macOS

Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users. Some systems may automatically restart critical applications and services when crashes occur, but they can likely be re-exploited to cause a persistent denial of…

Sub-technique of Endpoint Denial of Service (T1499).

Sigma detection rules (4)

T1499.004 Endpoint Denial of Service: Application or System Exploitation

title: "T1499.004 Endpoint Denial of Service: Application or System Exploitation"
id: b55cf477-0b93-42d3-8c4d-4cf84101da63
description: 'Detects repeated application-crash error reporting for critical/security processes, a Windows-observable proxy for DoS caused by exploiting a software vulnerability to crash an application or system (the exploit itself is not visible in Sysmon/Security telemetry -- only its crash side-effect is). Tune using: TimeWindow, TargetApplication.'
references:
  - https://attack.mitre.org/techniques/T1499/004
author: Shahrukh Khan
date: 2026-05-01
license: MIT
tags:
  - attack.impact
  - attack.t1499.004

logsource:
  product: windows
  service: application

detection:
  selection:
    Provider_Name: 'Application Error'
    EventID: 1000
  filter_common:
    AppName|contains:
      - 'notepad.exe'
      - 'explorer.exe'

  condition: selection and not filter_common

falsepositives:
  - Unstable but non-malicious software crashing repeatedly (buggy drivers, memory leaks); this rule needs scoping to specific critical/security-software process names to be useful.

level: medium

T1499.004 Endpoint Denial of Service: Application or System Exploitation

title: "T1499.004 Endpoint Denial of Service: Application or System Exploitation"
id: e029ccf3-62a3-4534-a66b-5739a8037d80
description: 'Detection Strategy for Endpoint DoS via Application or System Exploitation: flags abnormal/fatal process termination (auditd ANOM_ABEND records, emitted by the kernel audit subsystem when a process is killed by a core-dump-triggering signal such as SIGSEGV/SIGABRT/SIGILL/SIGBUS/SIGFPE), the real observable proxy for an application crashing due to exploitation, rather than a normal exit_group syscall exit (which does not "fail" under these conditions and carries no crash signal). Repeated ANOM_ABEND events for the same executable in a short window are the strongest indicator of repeated re-exploitation and should be correlated externally. Tune using: CrashPattern, ExploitSourceIP.'
references:
  - https://attack.mitre.org/techniques/T1499/004
author: Shahrukh Khan
date: 2026-01-15
license: MIT
tags:
  - attack.impact
  - attack.t1499.004

logsource:
  product: linux
  service: auditd

detection:
  selection:
    type: ANOM_ABEND
    sig:
      - '11'
      - '6'
      - '4'
      - '8'
      - '7'
  condition: selection

falsepositives:
  - Legitimate application bugs/crashes unrelated to deliberate exploitation are common; distinguishing exploit-induced crashes from ordinary software defects requires additional context (repeated crashes of the same service, correlation with external network-exploitation indicators) beyond a raw auditd abend record.

level: medium

T1499.004 Endpoint Denial of Service: Application or System Exploitation

title: "T1499.004 Endpoint Denial of Service: Application or System Exploitation"
id: eeadc060-ba0e-4f69-a2ac-8084cc65c484
description: 'Detection Strategy for Endpoint DoS via Application or System Exploitation. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: CrashSignature, InputVector.'
references:
  - https://attack.mitre.org/techniques/T1499/004
author: Shahrukh Khan
date: 2026-05-29
license: MIT
tags:
  - attack.impact
  - attack.t1499.004

logsource:
  product: macos

detection:
  selection:
    Image|endswith:
      - '/ReportCrash'
      - '/spindump'
  condition: selection

falsepositives:
  - Crash and spin reports of the same type recur naturally from unrelated software bugs, so distinguishing a deliberate exploitation-triggered application exhaustion attack requires knowledge of the specific crash signature and repeated external input vector, neither of which is captured in unified log crash telemetry.

level: medium

T1499.004 Endpoint Denial of Service: Application or System Exploitation

title: "T1499.004 Endpoint Denial of Service: Application or System Exploitation"
id: ca5ba462-1e3d-4cb3-a656-69db0b2751b1
description: 'Detection Strategy for Endpoint DoS via Application or System Exploitation. (Retargeted to the cloudtrail AWS telemetry that actually captures this techniques behavior; see logsource below.) Tune using: CrashThreshold, ServiceID.'
references:
  - https://attack.mitre.org/techniques/T1499/004
author: Shahrukh Khan
date: 2026-05-19
license: MIT
tags:
  - attack.impact
  - attack.t1499.004

logsource:
  category: cloudtrail
  product: aws

detection:
  selection:
    eventSource: 'ec2.amazonaws.com'
    eventName: 'StopInstances'
  selection_reason:
    requestParameters.force: true

  condition: selection and selection_reason

falsepositives:
  - Autoscaling policies and legitimate maintenance windows use forced instance stops routinely, so correlate the frequency and target service identifiers against known maintenance schedules before escalating.

level: medium

Related sub-techniques

Explore