Cross-source coverage

T1499.004 / ATT&CK

Endpoint Denial of Service: Application or System Exploitation

4 rules across 2 sources.

From MITRE ATT&CK 19.2

Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users. Some systems may automatically restart critical applications and services when crashes occur, but they can likely be re-exploited to cause a persistent denial of service (DoS) condition.

Adversaries may exploit known or zero-day vulnerabilities to crash applications and/or systems, which may also lead to dependent applications and/or systems to be in a DoS condition. Crashed or restarted applications or systems may also have other effects such as Data Destruction, Firmware Corruption, Service Stop etc. which may further cause a DoS condition and deny availability to critical information, applications and/or systems.

Tactics
Impact
Platforms
Windows · IaaS · Linux · macOS
Telemetry
WinEventLog:ApplicationWinEventLog:SysmonWinEventLog:Systemauditd:SYSCALLjournald:ApplicationNSM:Flowmacos:unifiedlogAWS:CloudTrailAWS:CloudWatchAWS:VPCFlowLogs

How MITRE says to detect it DET0304

Detection Strategy for Endpoint DoS via Application or System Exploitation

Windows Analytic 0850

Exploitation of system or application vulnerability (e.g., CVE-based exploit) followed by service crash, restart, or repeated failure within a short time frame, impacting application/system availability.

  • WinEventLog:Application EventCode=1000
  • WinEventLog:Sysmon EventCode=1
  • WinEventLog:System EventCode=7031, 7034

Linux Analytic 0851

User or remote input triggers application crash or segmentation fault (e.g., SIGSEGV) with service recovery attempts, observed via audit logs and systemd journaling.

  • auditd:SYSCALL Process segfault or abnormal termination after invoking vulnerable syscall sequence
  • journald:Application Segfault or crash log entry associated with specific application binary
  • NSM:Flow Unusual request pattern leading up to service crash (e.g., malformed or oversized payload)

macOS Analytic 0852

Application crash or repeated restart cycle triggered by malformed input or exploit file, observed via unified logs and process crash monitoring.

  • macos:unifiedlog Crash log entries for a process receiving malformed input or known exploit patterns
  • macos:unifiedlog Unusual child process tree indicating attempted recovery after crash

IaaS Analytic 0853

Cloud workload exploitation leads to repeated container, service, or VM termination/restart, typically associated with CVE-based crash triggers or fuzzed payloads.

  • AWS:CloudTrail TerminateInstances
  • AWS:CloudWatch Repeated crash pattern within container or instance logs
  • AWS:VPCFlowLogs Large volume of malformed or synthetic payloads to application endpoints prior to failure

View on attack.mitre.org ↗

SigmaHQ/sigma

3 rules
Detection Severity Format
Audit CVE Event Critical Sigma
Apache Segmentation Fault High Sigma
Nginx Core Dump High Sigma

elastic/detection-rules

1 rule
Detection Severity Format
Abnormally Large DNS Response Medium Elastic TOML

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.