Endpoint Denial of Service (T1499) — ATT&CK

Events covered

13 catalog events are tagged with this technique by at least one rule.

Provider	Event	Title
Sysmon	Event ID 3	Network connection
Security-Auditing	Event ID 5152	The Windows Filtering Platform blocked a packet.
Security-Auditing	Event ID 5154	The Windows Filtering Platform has permitted an application or service to listen on a port for incoming connections.
Security-Auditing	Event ID 5155	The Windows Filtering Platform has blocked an application or service from listening on a port for incoming connections.
Security-Auditing	Event ID 5156	The Windows Filtering Platform has permitted a connection.
Security-Auditing	Event ID 5157	The Windows Filtering Platform has blocked a connection.
Security-Auditing	Event ID 5158	The Windows Filtering Platform has permitted a bind to a local port.
Security-Auditing	Event ID 5159	The Windows Filtering Platform has blocked a bind to a local port.
Application-Error	Event ID 1000	Faulting application name: Faulting_application_name, version: version, time stamp: 0xFaulting_module_name.
Linux-Auditd	Event ID 1302	PATH
Linux-Auditd	Event ID 1307	CWD
Audit-CVE	Event ID 1	Possible detection of CVE: PossibleDetectionOfCVE.
Ntfs	Event ID 55	A corruption was discovered in the file system structure on volume DriveName.

Authoring guide

These 47 rules share fields, values, and exclusions.

Fields filtered most (77 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`DeviceEventClassID`	6	`ne` 4, `eq` 2	`asc`, `audit`, `campaigns`, `hsc`
`DeviceProduct`	6	`eq` 6	`X Series`
`DeviceVendor`	6	`eq` 6	`Vectra Networks`
`EventType`	4	`eq` 3, `in` 1	`DetectionSummaryEvent`, `application.integration.rate_limit_exceeded`, `core.concurrency.org.limit.violation`, `errorlog`, `intrusionevent`
`Provider_Name`	4	`eq` 4	`application error`, `audit-cve`, `microsoft-windows-audit-cve`, `ntfs`
`sourcetype`	4	`eq` 3, `in` 1	`auditd`, `cisco:sfw:estreamer`, `ollama:server`, `vmw-syslog`, `vmware:esxlog*`
`Status`	3	`eq` 3	`429`, `deny`, `offline`
`triaged`	3	`ne` 3	`True`
`Category`	2	`in` 2	`BOTNET ACTIVITY`, `COMMAND & CONTROL`, `EXFILTRATION`
`aws::errorCode`	2	`is_null` 2
`aws::eventName`	2	`in` 2	`FailoverDBCluster`, `FailoverGlobalCluster`, `RebootDBCluster`, `RebootDBInstance`, `RebootDBShardGroup`
`aws::eventSource`	2	`eq` 2	`rds.amazonaws.com`
`data.description`	2	`eq` 2	`dynamic client registration`, `guardian - second factor sms sent`
`data.type`	2	`eq` 2	`gd_send_sms`, `sapi`
`data_stream.dataset`	2	`eq` 1, `in` 1	`network_traffic.dns`, `okta.system`, `zeek.dns`

Top indicator values (130 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`DeviceProduct`	`eq`	`X Series` kustoVectra Account's Behaviors kustoVectra AI Detect - Detections with High Severity kustoVectra AI Detect - Suspected Compromised Account kustoVectra AI Detect - Suspected Compromised Host kustoVectra AI Detect - Suspicious Behaviors by Category kustoVectra Host's Behaviors	6	7
`DeviceVendor`	`eq`	`Vectra Networks` kustoVectra Account's Behaviors kustoVectra AI Detect - Detections with High Severity kustoVectra AI Detect - Suspected Compromised Account kustoVectra AI Detect - Suspected Compromised Host kustoVectra AI Detect - Suspicious Behaviors by Category kustoVectra Host's Behaviors	6	7
`DeviceEventClassID`	`ne`	`asc` kustoVectra Account's Behaviors kustoVectra AI Detect - Detections with High Severity kustoVectra AI Detect - Suspicious Behaviors by Category kustoVectra Host's Behaviors	4	4
`DeviceEventClassID`	`ne`	`audit` kustoVectra Account's Behaviors kustoVectra AI Detect - Detections with High Severity kustoVectra AI Detect - Suspicious Behaviors by Category kustoVectra Host's Behaviors	4	4
`DeviceEventClassID`	`ne`	`campaigns` kustoVectra Account's Behaviors kustoVectra AI Detect - Detections with High Severity kustoVectra AI Detect - Suspicious Behaviors by Category kustoVectra Host's Behaviors	4	4
`DeviceEventClassID`	`ne`	`health` kustoVectra Account's Behaviors kustoVectra AI Detect - Detections with High Severity kustoVectra AI Detect - Suspicious Behaviors by Category kustoVectra Host's Behaviors	4	4
`DeviceEventClassID`	`ne`	`hsc` kustoVectra Account's Behaviors kustoVectra AI Detect - Detections with High Severity kustoVectra AI Detect - Suspicious Behaviors by Category kustoVectra Host's Behaviors	4	4
`triaged`	`ne`	`True` kustoVectra Account's Behaviors kustoVectra AI Detect - Suspicious Behaviors by Category kustoVectra Host's Behaviors	3	3
`Category`	`in`	`BOTNET ACTIVITY` kustoVectra AI Detect - Detections with High Severity kustoVectra AI Detect - Suspicious Behaviors by Category	2	2
`Category`	`in`	`COMMAND & CONTROL` kustoVectra AI Detect - Detections with High Severity kustoVectra AI Detect - Suspicious Behaviors by Category	2	2
`Category`	`in`	`EXFILTRATION` kustoVectra AI Detect - Detections with High Severity kustoVectra AI Detect - Suspicious Behaviors by Category	2	2
`Category`	`in`	`LATERAL MOVEMENT` kustoVectra AI Detect - Detections with High Severity kustoVectra AI Detect - Suspicious Behaviors by Category	2	2
`Category`	`in`	`RECONNAISSANCE` kustoVectra AI Detect - Detections with High Severity kustoVectra AI Detect - Suspicious Behaviors by Category	2	2
`Provider_Name`	`eq`	`application error` sigmaCVE-2024-49113 Exploitation Attempt - LDAP Nightmare sigmaLSASS Crash Via Netlogon Stack Buffer Overflow - CVE-2026-41089	2	5
`aws::eventSource`	`eq`	`rds.amazonaws.com` pantherAWS RDS Cluster Failover Initiated pantherAWS RDS Instance or Cluster Rebooted	2	23
`level`	`in`	`Critical` kustoVectra AI Detect - Suspected Compromised Account kustoVectra AI Detect - Suspected Compromised Host	2	2
`level`	`in`	`High` kustoVectra AI Detect - Suspected Compromised Account kustoVectra AI Detect - Suspected Compromised Host	2	2
`type`	`eq`	`path` sigmaPotential Abuse of Linux Magic System Request Key splunkLinux Magic SysRq Key Abuse	2	19
`AdditionalExtensions`	`contains`	`account` kustoVectra Account's Behaviors	1
`AppName`	`eq`	`lsass.exe` sigmaLSASS Crash Via Netlogon Stack Buffer Overflow - CVE-2026-41089	1	2
`AvgUptime`	`lt`	`99.9` kustoUniFi Site Manager: ISP SLA Breach	1
`Computer`	`in`	`DC01.simulandlabs.com` kustoMissing Domain Controller Heartbeat	1
`Computer`	`in`	`DC02.simulandlabs.com` kustoMissing Domain Controller Heartbeat	1
`Count`	`gt`	`5000` kustoExcessive number of failed connections from a single source (ASIM Network Session schema)	1	3
`CriticalCount`	`cross_field_compare`	`prevCritical` kustoUniFi Site Manager: New critical notifications appeared	1
`Data`	`contains`	`lsass.exe` sigmaCVE-2024-49113 Exploitation Attempt - LDAP Nightmare	1
`Data`	`contains`	`wldap32.dll` sigmaCVE-2024-49113 Exploitation Attempt - LDAP Nightmare	1
`Description`	`contains`	`contains a corrupted file record` sigmaNTFS Vulnerability Exploitation	1
`Description`	`contains`	`the name of the file is "\"` sigmaNTFS Vulnerability Exploitation	1
`DestinationPort`	`eq`	`53` elasticAbnormally Large DNS Response	1

Exclusions (7 distinct)

These values appear most often in top-level exclusions.

Field	Kind	Value	Rules excluding
`AdditionalExtensions`	`contains`	`account` kustoVectra Host's Behaviors	1
`EventType`	`in`	`flow_terminated` elasticAbnormally Large DNS Response	1
`EventType`	`in`	`network_flow` elasticAbnormally Large DNS Response	1
`data_stream.dataset`	`eq`	`zeek.connection` elasticAbnormally Large DNS Response	1
`event.dataset`	`eq`	`conn` elasticAbnormally Large DNS Response	1
`event.duration`	`gt`	`60000000000` elasticAbnormally Large DNS Response	1
`event.module`	`eq`	`corelight` elasticAbnormally Large DNS Response	1

Endpoint Denial of Service `T1499`

Events covered

Authoring guide

Fields filtered most (77 distinct)

Top indicator values (130 distinct)

Exclusions (7 distinct)

Rules under this technique

Sigma 9 rules

Elastic 6 rules

Splunk 5 rules

Kusto 22 rules

Panther 5 rules

Endpoint Denial of Service T1499

Events covered

Authoring guide

Fields filtered most (77 distinct)

Top indicator values (130 distinct)

Exclusions (7 distinct)

Rules under this technique

Sigma 9 rules

Elastic 6 rules

Splunk 5 rules

Kusto 22 rules

Panther 5 rules

Endpoint Denial of Service `T1499`