{"id":"T1499.003","name":"Application Exhaustion Flood","url":"https://attack.mitre.org/techniques/T1499/003","tactics":["impact"],"platforms":["Windows","IaaS","Linux","macOS"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0415","stix_id":"x-mitre-detection-strategy--430abda8-2a2c-4ab8-bbd6-eb205a189362","name":"Application Exhaustion Flood Detection Across Platforms","url":"https://attack.mitre.org/detectionstrategies/DET0415","analytics":[{"id":"AN1165","stix_id":"x-mitre-analytic--0b514d96-12ce-41e2-b870-b35933d7faa6","name":"Analytic 1165","description":"Repeated invocation of high-resource application endpoints or GUI components causing CPU and memory spikes, logged as elevated request volumes, prolonged handle locks, or frequent crash recoveries.","url":"https://attack.mitre.org/detectionstrategies/DET0415#AN1165","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Application","channel":"High-frequency errors or hangs from resource-intensive application components (e.g., .NET, IIS, Office Suite)","data_component":"DC0038","data_component_name":"Application Log Content","log_source_slug":"wineventlog-application"},{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"},{"name":"Windows:perfmon","channel":"Sudden spikes in CPU/Memory usage linked to specific application processes","data_component":"DC0018","data_component_name":"Host Status","log_source_slug":"windows-perfmon"}],"mutable_elements":[{"field":"CPUThreshold","description":"Define what percentage of CPU usage indicates abnormal behavior."},{"field":"MemoryConsumptionWindow","description":"Window (e.g., 5 mins) during which sustained memory usage may be abnormal."},{"field":"AppCrashFrequency","description":"Threshold for frequency of application faults within a specific interval."}],"live":true,"detection_strategies":["DET0415"],"techniques":["T1499.003"]},{"id":"AN1166","stix_id":"x-mitre-analytic--35c7be24-c1c0-4ddc-9356-dec5e39414be","name":"Analytic 1166","description":"Automated scripts or repeated CLI/API requests that trigger application backends to consume high CPU or memory (e.g., Apache/PHP, MySQL, mail servers), resulting in syslog errors and excessive process spawning.","url":"https://attack.mitre.org/detectionstrategies/DET0415#AN1166","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"execve","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"auditd-syscall"},{"name":"linux:syslog","channel":"Error/warning logs from services indicating load spike or worker exhaustion","data_component":"DC0038","data_component_name":"Application Log Content","log_source_slug":"linux-syslog"},{"name":"NSM:Flow","channel":"Sustained abnormal inbound request rate targeting application ports (e.g., 80/443/25)","data_component":"DC0085","data_component_name":"Network Traffic Content","log_source_slug":"nsm-flow"}],"mutable_elements":[{"field":"SyslogErrorRate","description":"Defines number of critical errors in logs within time window."},{"field":"PortRequestSpikeThreshold","description":"Spike rate on monitored service port triggering alert."},{"field":"ProcessSpawnRate","description":"Rate of process creation that may overwhelm the system."}],"live":true,"detection_strategies":["DET0415"],"techniques":["T1499.003"]},{"id":"AN1167","stix_id":"x-mitre-analytic--ade844ef-f156-4db2-bc11-9dbdc006c8d6","name":"Analytic 1167","description":"Repetitive triggering of GUI or backend application workflows that cause increased CPU/memory usage, logged in unified logs as spin reports or crash dumps.","url":"https://attack.mitre.org/detectionstrategies/DET0415#AN1167","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"Application errors or resource contention from excessive frontend or script invocation","data_component":"DC0038","data_component_name":"Application Log Content","log_source_slug":"macos-unifiedlog"},{"name":"macos:osquery","channel":"Rapid spawning of resource-heavy applications (e.g., Preview, Safari, Office)","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"macos-osquery"}],"mutable_elements":[{"field":"SpinReportCount","description":"Threshold for number of system spin/crash reports in a defined window."},{"field":"HeavyAppReopenRate","description":"Frequency of user or script reopening GUI-heavy apps."}],"live":true,"detection_strategies":["DET0415"],"techniques":["T1499.003"]},{"id":"AN1168","stix_id":"x-mitre-analytic--867239cd-7939-446c-9efb-b2a7a5bd5403","name":"Analytic 1168","description":"Automated abuse of cloud-hosted applications (e.g., web apps, REST endpoints, internal APIs) causing compute exhaustion, high 5xx error rates, or frequent autoscaling triggers logged in app insights or cloudwatch.","url":"https://attack.mitre.org/detectionstrategies/DET0415#AN1168","platforms":["IaaS"],"log_source_references":[{"name":"AWS:CloudWatch","channel":"Elevated 5xx response rates in application logs or gateway layer","data_component":"DC0038","data_component_name":"Application Log Content","log_source_slug":"aws-cloudwatch"},{"name":"AWS:CloudTrail","channel":"InvokeFunction","data_component":"DC0070","data_component_name":"Cloud Service Metadata","log_source_slug":"aws-cloudtrail"},{"name":"AWS:CloudMetrics","channel":"Autoscaling, memory/cpu alarms, or instance unhealthiness","data_component":"DC0018","data_component_name":"Host Status","log_source_slug":"aws-cloudmetrics"}],"mutable_elements":[{"field":"HTTP5xxRateThreshold","description":"Ratio of 5xx error codes over requests indicating resource exhaustion."},{"field":"FunctionInvocationRate","description":"Spike in lambda/API gateway executions indicating scripted behavior."},{"field":"AutoscaleEventCount","description":"Triggers linked to app DoS where legitimate scaling is mimicked."}],"live":true,"detection_strategies":["DET0415"],"techniques":["T1499.003"]}],"live":true,"version":"1.0","techniques":["T1499.003"]}],"sigma_rules":[],"kev_cves":[],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}