T1499.003 / ATT&CK

Windows Analytic 1165

Repeated invocation of high-resource application endpoints or GUI components causing CPU and memory spikes, logged as elevated request volumes, prolonged handle locks, or frequent crash recoveries.

• WinEventLog:Application High-frequency errors or hangs from resource-intensive application components (e.g., .NET, IIS, Office Suite)
• WinEventLog:Sysmon EventCode=1
• Windows:perfmon Sudden spikes in CPU/Memory usage linked to specific application processes

Linux Analytic 1166

Automated scripts or repeated CLI/API requests that trigger application backends to consume high CPU or memory (e.g., Apache/PHP, MySQL, mail servers), resulting in syslog errors and excessive process spawning.

• auditd:SYSCALL execve
• linux:syslog Error/warning logs from services indicating load spike or worker exhaustion
• NSM:Flow Sustained abnormal inbound request rate targeting application ports (e.g., 80/443/25)

macOS Analytic 1167

Repetitive triggering of GUI or backend application workflows that cause increased CPU/memory usage, logged in unified logs as spin reports or crash dumps.

• macos:unifiedlog Application errors or resource contention from excessive frontend or script invocation
• macos:osquery Rapid spawning of resource-heavy applications (e.g., Preview, Safari, Office)

IaaS Analytic 1168

Automated abuse of cloud-hosted applications (e.g., web apps, REST endpoints, internal APIs) causing compute exhaustion, high 5xx error rates, or frequent autoscaling triggers logged in app insights or cloudwatch.

• AWS:CloudWatch Elevated 5xx response rates in application logs or gateway layer
• AWS:CloudTrail InvokeFunction
• AWS:CloudMetrics Autoscaling, memory/cpu alarms, or instance unhealthiness