Endpoint Denial of Service `T1499`

Tactic: Impact

Adversaries may perform Endpoint Denial of Service (DoS) attacks to degrade or block the availability of services to users. Endpoint DoS can be performed by exhausting the system resources those services are hosted on or exploiting the system to cause a persistent crash condition. Example services include websites, email services, DNS, and web-based applications. Adversaries have been observed conducting DoS attacks for political purposes and to support other malicious activities, including distraction, hacktivism, and extortion.

Events covered

13 catalog events are tagged with this technique by at least one rule.

Provider	Event	Title
Sysmon	Event ID 3	Network connection
Security-Auditing	Event ID 5152	The Windows Filtering Platform blocked a packet.
Security-Auditing	Event ID 5154	The Windows Filtering Platform has permitted an application or service to listen on a port for incoming connections.
Security-Auditing	Event ID 5155	The Windows Filtering Platform has blocked an application or service from listening on a port for incoming connections.
Security-Auditing	Event ID 5156	The Windows Filtering Platform has permitted a connection.
Security-Auditing	Event ID 5157	The Windows Filtering Platform has blocked a connection.
Security-Auditing	Event ID 5158	The Windows Filtering Platform has permitted a bind to a local port.
Security-Auditing	Event ID 5159	The Windows Filtering Platform has blocked a bind to a local port.
Application-Error	Event ID 1000	Faulting application name: Faulting_application_name, version: version, time stamp: 0xFaulting_module_name.
Linux-Auditd	Event ID 1302	PATH
Linux-Auditd	Event ID 1307	CWD
Audit-CVE	Event ID 1	Possible detection of CVE: PossibleDetectionOfCVE.
Ntfs	Event ID 55	A corruption was discovered in the file system structure on volume DriveName.

Authoring guide

These 48 rules share fields, values, and exclusions.

Fields filtered most (61 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`DeviceEventClassID`	6	`ne` 4, `eq` 2	`asc`, `audit`, `campaigns`, `hsc`
`DeviceProduct`	6	`eq` 6	`X Series`
`DeviceVendor`	6	`eq` 6	`Vectra Networks`
`EventType`	4	`eq` 3, `in` 1	`DetectionSummaryEvent`, `ErrorLog`, `IntrusionEvent`, `application.integration.rate_limit_exceeded`, `core.concurrency.org.limit.violation`
`Provider_Name`	4	`eq` 4	`Application Error`, `Audit-CVE`, `Microsoft-Windows-Audit-CVE`, `Ntfs`
`sourcetype`	4	`eq` 3, `in` 1	`auditd`, `cisco:sfw:estreamer`, `ollama:server`, `vmw-syslog`, `vmware:esxlog*`
`DeviceCustomString5`	3	`ne` 3	`True`
`Status`	3	`eq` 3	`429`, `Deny`, `offline`
`Severity`	2	`eq` 1, `in` 1	`Critical`, `High`
`aws::errorCode`	2	`is_null` 2
`aws::eventName`	2	`in` 2	`FailoverDBCluster`, `FailoverGlobalCluster`, `RebootDBCluster`, `RebootDBInstance`, `RebootDBShardGroup`
`aws::eventSource`	2	`eq` 2	`rds.amazonaws.com`
`data.description`	2	`eq` 2	`Dynamic client registration`, `Guardian - Second factor sms sent`
`data.type`	2	`eq` 2	`gd_send_sms`, `sapi`
`data_stream.dataset`	2	`eq` 1, `in` 1	`network_traffic.dns`, `okta.system`, `zeek.dns`

Top indicator values (117 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`DeviceProduct`	`eq`	`X Series` kustoVectra Account's Behaviors kustoVectra AI Detect - Detections with High Severity kustoVectra AI Detect - Suspected Compromised Account kustoVectra AI Detect - Suspected Compromised Host kustoVectra AI Detect - Suspicious Behaviors by Category kustoVectra Host's Behaviors	6	7
`DeviceVendor`	`eq`	`Vectra Networks` kustoVectra Account's Behaviors kustoVectra AI Detect - Detections with High Severity kustoVectra AI Detect - Suspected Compromised Account kustoVectra AI Detect - Suspected Compromised Host kustoVectra AI Detect - Suspicious Behaviors by Category kustoVectra Host's Behaviors	6	7
`DeviceEventClassID`	`ne`	`asc` kustoVectra Account's Behaviors kustoVectra AI Detect - Detections with High Severity kustoVectra AI Detect - Suspicious Behaviors by Category kustoVectra Host's Behaviors	4	4
`DeviceEventClassID`	`ne`	`audit` kustoVectra Account's Behaviors kustoVectra AI Detect - Detections with High Severity kustoVectra AI Detect - Suspicious Behaviors by Category kustoVectra Host's Behaviors	4	4
`DeviceEventClassID`	`ne`	`campaigns` kustoVectra Account's Behaviors kustoVectra AI Detect - Detections with High Severity kustoVectra AI Detect - Suspicious Behaviors by Category kustoVectra Host's Behaviors	4	4
`DeviceEventClassID`	`ne`	`health` kustoVectra Account's Behaviors kustoVectra AI Detect - Detections with High Severity kustoVectra AI Detect - Suspicious Behaviors by Category kustoVectra Host's Behaviors	4	4
`DeviceEventClassID`	`ne`	`hsc` kustoVectra Account's Behaviors kustoVectra AI Detect - Detections with High Severity kustoVectra AI Detect - Suspicious Behaviors by Category kustoVectra Host's Behaviors	4	4
`DeviceCustomString5`	`ne`	`True` kustoVectra Account's Behaviors kustoVectra AI Detect - Suspicious Behaviors by Category kustoVectra Host's Behaviors	3	3
`Provider_Name`	`eq`	`Application Error` sigmaCVE-2024-49113 Exploitation Attempt - LDAP Nightmare sigmaLSASS Crash Via Netlogon Stack Buffer Overflow - CVE-2026-41089	2	5
`aws::errorCode`	`is_null`	pantherAWS RDS Cluster Failover Initiated pantherAWS RDS Instance or Cluster Rebooted	2	50
`aws::eventSource`	`eq`	`rds.amazonaws.com` pantherAWS RDS Cluster Failover Initiated pantherAWS RDS Instance or Cluster Rebooted	2	18
`type`	`eq`	`PATH` sigmaPotential Abuse of Linux Magic System Request Key splunkLinux Magic SysRq Key Abuse	2	19
`AdditionalExtensions`	`contains`	`account` kustoVectra Account's Behaviors	1
`AppName`	`eq`	`lsass.exe` sigmaLSASS Crash Via Netlogon Stack Buffer Overflow - CVE-2026-41089	1	2
`Computer`	`in`	`DC01.simulandlabs.com` kustoMissing Domain Controller Heartbeat	1
`Computer`	`in`	`DC02.simulandlabs.com` kustoMissing Domain Controller Heartbeat	1
`Data`	`contains`	`WLDAP32.dll` sigmaCVE-2024-49113 Exploitation Attempt - LDAP Nightmare	1
`Data`	`contains`	`lsass.exe` sigmaCVE-2024-49113 Exploitation Attempt - LDAP Nightmare	1
`Description`	`contains`	`The name of the file is "\"` sigmaNTFS Vulnerability Exploitation	1
`Description`	`contains`	`contains a corrupted file record` sigmaNTFS Vulnerability Exploitation	1
`DestinationPort`	`eq`	`53` elasticAbnormally Large DNS Response	1
`DestinationPortName`	`eq`	`dns` elasticAbnormally Large DNS Response	1
`DeviceEventClassID`	`eq`	`asc` kustoVectra AI Detect - Suspected Compromised Account	1
`DeviceEventClassID`	`eq`	`hsc` kustoVectra AI Detect - Suspected Compromised Host	1
`Esql.event_count`	`ge`	`5` elasticRepeated Stalled TLS Handshakes via ALPN acme-tls/1 Extension	1
`EventID`	`eq`	`1000` splunkPotential CVE-2024-49113 - LDAPNightmare (Windows Event Log)	1
`EventMessage`	`contains`	`exited on signal 6 (core dumped)` kustoNGINX - Core Dump	1
`EventType`	`eq`	`DetectionSummaryEvent` kustoCommon Event Format (CEF) via AMA - Critical Severity Detection	1	2
`EventType`	`eq`	`ErrorLog` kustoNGINX - Core Dump	1
`EventType`	`eq`	`IntrusionEvent` splunkCisco Secure Firewall - Static Tundra Smart Install Abuse	1	18

Exclusions (7 distinct)

These values appear most often in top-level exclusions.

Field	Kind	Value	Rules excluding
`AdditionalExtensions`	`contains`	`account` kustoVectra Host's Behaviors	1
`EventType`	`in`	`flow_terminated` elasticAbnormally Large DNS Response	1
`EventType`	`in`	`network_flow` elasticAbnormally Large DNS Response	1
`data_stream.dataset`	`eq`	`zeek.connection` elasticAbnormally Large DNS Response	1
`event.dataset`	`eq`	`conn` elasticAbnormally Large DNS Response	1
`event.duration`	`gt`	`60000000000` elasticAbnormally Large DNS Response	1
`event.module`	`eq`	`corelight` elasticAbnormally Large DNS Response	1

Endpoint Denial of Service `T1499`

Events covered

Authoring guide

Fields filtered most (61 distinct)

Top indicator values (117 distinct)

Exclusions (7 distinct)

Rules under this technique

Sigma 9 rules

Elastic 6 rules

Splunk 5 rules

Kusto 23 rules

Panther 5 rules

Endpoint Denial of Service T1499

Events covered

Authoring guide

Fields filtered most (61 distinct)

Top indicator values (117 distinct)

Exclusions (7 distinct)

Rules under this technique

Sigma 9 rules

Elastic 6 rules

Splunk 5 rules

Kusto 23 rules

Panther 5 rules

Endpoint Denial of Service `T1499`