Endpoint Denial of Service: Service Exhaustion Flood T1499.002

Tactic: Impact

Adversaries may target the different network services provided by systems to conduct a denial of service (DoS). Adversaries often target the availability of DNS and web services, however others have been targeted as well. Web server software can be attacked through a variety of means, some of which apply generally while others are specific to the software being used to provide the service.

Authoring guide

These 3 rules share fields, values, and exclusions.

Fields filtered most (11 distinct)

These fields appear most often in rule filters.

FieldRulesHowSample values
Esql.event_count1ge 15
EventType1in 1application.integration.rate_limit_exceeded, core.concurrency.org.limit.violation, system.org.rate_limit.violation
TO_LOWER(tls.detailed.client_hello.extensions._unparsed_)1contains 1alpn
data.description1eq 1guardian - second factor sms sent
data.type1eq 1gd_send_sms
data_stream.dataset1eq 1okta.system
dest_ip1is_not_null 1
src_ip1is_not_null 1
tls.detailed.alert_types1in 1decode_error, illegal_parameter
tls.detailed.client_hello.extensions.application_layer_protocol_negotiation1eq 1acme-tls/1
tls.established1eq 1false

Top indicator values (13 distinct)

These values appear most often in rule predicates.

FieldKindValueRules (here)Corpus reach
Esql.event_countge
5
1
EventTypein
application.integration.rate_limit_exceeded
1
EventTypein
core.concurrency.org.limit.violation
1
EventTypein
system.org.rate_limit.violation
1
EventTypein
system.org.rate_limit.warning
1
TO_LOWER(tls.detailed.client_hello.extensions._unparsed_)contains
alpn
1
data.descriptioneq
guardian - second factor sms sent
1
data.typeeq
gd_send_sms
1
data_stream.dataseteq
okta.system
148
tls.detailed.alert_typesin
decode_error
1
tls.detailed.alert_typesin
illegal_parameter
1
tls.detailed.client_hello.extensions.application_layer_protocol_negotiationeq
acme-tls/1
1
tls.establishedeq
false
1

Rules under this technique

These vendors publish rules tagged with this technique.

Platform (all)
Domain (all)

Sigma 1 rule

Elastic 2 rules