Endpoint Denial of Service: Application Exhaustion Flood `T1499.003`

Tactic: Impact

Adversaries may target resource intensive features of applications to cause a denial of service (DoS), denying availability to those applications. For example, specific features in web applications may be highly resource intensive. Repeated requests to those features may be able to exhaust system resources and deny access to the application or the server itself.

Authoring guide

These 2 rules share fields, values, and exclusions.

Fields filtered most (3 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`EventType`	1	`in` 1	`application.integration.rate_limit_exceeded`, `core.concurrency.org.limit.violation`, `system.org.rate_limit.violation`
`action`	1	`in` 1	`bulk_session_reset_by_admin`, `user_session_invalidated`, `user_session_reset_by_admin`
`data_stream.dataset`	1	`eq` 1	`okta.system`

Top indicator values (8 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`EventType`	`in`	`application.integration.rate_limit_exceeded` elasticPossible Okta DoS Attack	1
`EventType`	`in`	`core.concurrency.org.limit.violation` elasticPossible Okta DoS Attack	1
`EventType`	`in`	`system.org.rate_limit.violation` elasticPossible Okta DoS Attack	1
`EventType`	`in`	`system.org.rate_limit.warning` elasticPossible Okta DoS Attack	1
`action`	`in`	`bulk_session_reset_by_admin` pantherSlack Denial of Service via Session Invalidation	1
`action`	`in`	`user_session_invalidated` pantherSlack Denial of Service via Session Invalidation	1
`action`	`in`	`user_session_reset_by_admin` pantherSlack Denial of Service via Session Invalidation	1
`data_stream.dataset`	`eq`	`okta.system` elasticPossible Okta DoS Attack	1	48

Rules under this technique

These vendors publish rules tagged with this technique.

Elastic 1 rule

Possible Okta DoS Attack

Panther 1 rule

Slack Denial of Service via Session Invalidation