Endpoint Denial of Service: OS Exhaustion Flood `T1499.001`

Tactic: Impact

Adversaries may launch a denial of service (DoS) attack targeting an endpoint's operating system (OS). A system's OS is responsible for managing the finite resources as well as preventing the entire system from being overwhelmed by excessive demands on its capacity. These attacks do not need to exhaust the actual resources on a system; the attacks may simply exhaust the limits and available resources that an OS self-imposes.

Events covered

1 catalog event is tagged with this technique by at least one rule.

Provider	Event	Title
Ntfs	Event ID 55	A corruption was discovered in the file system structure on volume DriveName.

Authoring guide

These 1 rule share fields, values, and exclusions.

Fields filtered most (3 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`Description`	1	`contains` 1	`contains a corrupted file record`, `the name of the file is "\"`
`Origin`	1	`eq` 1	`file system driver`
`Provider_Name`	1	`eq` 1	`ntfs`

Top indicator values (4 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)
`Description`	`contains`	`contains a corrupted file record` sigmaNTFS Vulnerability Exploitation	1
`Description`	`contains`	`the name of the file is "\"` sigmaNTFS Vulnerability Exploitation	1
`Origin`	`eq`	`file system driver` sigmaNTFS Vulnerability Exploitation	1
`Provider_Name`	`eq`	`ntfs` sigmaNTFS Vulnerability Exploitation	1

Rules under this technique

These vendors publish rules tagged with this technique.

Platform: Windows

Domain: Endpoint

Sigma 1 rule

NTFS Vulnerability Exploitation