{"id":"T1499.004","name":"Application or System Exploitation","url":"https://attack.mitre.org/techniques/T1499/004","tactics":["impact"],"platforms":["Windows","IaaS","Linux","macOS"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0304","stix_id":"x-mitre-detection-strategy--28d6ebc3-3b01-45e1-b48e-6491364d23e9","name":"Detection Strategy for Endpoint DoS via Application or System Exploitation","url":"https://attack.mitre.org/detectionstrategies/DET0304","analytics":[{"id":"AN0850","stix_id":"x-mitre-analytic--6bb68520-c27e-435a-86b5-eb2ce7841cb2","name":"Analytic 0850","description":"Exploitation of system or application vulnerability (e.g., CVE-based exploit) followed by service crash, restart, or repeated failure within a short time frame, impacting application/system availability.","url":"https://attack.mitre.org/detectionstrategies/DET0304#AN0850","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Application","channel":"EventCode=1000","data_component":"DC0038","data_component_name":"Application Log Content","log_source_slug":"wineventlog-application"},{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:System","channel":"EventCode=7031, 7034","data_component":"DC0060","data_component_name":"Service Creation","log_source_slug":"wineventlog-system"}],"mutable_elements":[{"field":"TimeWindow","description":"Time window between repeated service crashes or restarts (e.g., 5 crashes within 1 hour)"},{"field":"TargetApplication","description":"Critical applications to monitor based on environment (e.g., web server, database, VPN)"}],"live":true,"detection_strategies":["DET0304"],"techniques":["T1499.004"]},{"id":"AN0851","stix_id":"x-mitre-analytic--2f4d199c-4d62-4d7d-8c6e-3ec358c22e76","name":"Analytic 0851","description":"User or remote input triggers application crash or segmentation fault (e.g., SIGSEGV) with service recovery attempts, observed via audit logs and systemd journaling.","url":"https://attack.mitre.org/detectionstrategies/DET0304#AN0851","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"Process segfault or abnormal termination after invoking vulnerable syscall sequence","data_component":"DC0033","data_component_name":"Process Termination","log_source_slug":"auditd-syscall"},{"name":"journald:Application","channel":"Segfault or crash log entry associated with specific application binary","data_component":"DC0038","data_component_name":"Application Log Content","log_source_slug":"journald-application"},{"name":"NSM:Flow","channel":"Unusual request pattern leading up to service crash (e.g., malformed or oversized payload)","data_component":"DC0085","data_component_name":"Network Traffic Content","log_source_slug":"nsm-flow"}],"mutable_elements":[{"field":"CrashPattern","description":"Specific binary fault signature or stack trace identifiers unique to the application context"},{"field":"ExploitSourceIP","description":"Suspect source IPs for correlation across requests and service failure timing"}],"live":true,"detection_strategies":["DET0304"],"techniques":["T1499.004"]},{"id":"AN0852","stix_id":"x-mitre-analytic--e6b92e19-5bc8-414b-b200-96ed6d286388","name":"Analytic 0852","description":"Application crash or repeated restart cycle triggered by malformed input or exploit file, observed via unified logs and process crash monitoring.","url":"https://attack.mitre.org/detectionstrategies/DET0304#AN0852","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"Crash log entries for a process receiving malformed input or known exploit patterns","data_component":"DC0038","data_component_name":"Application Log Content","log_source_slug":"macos-unifiedlog"},{"name":"macos:unifiedlog","channel":"Unusual child process tree indicating attempted recovery after crash","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"macos-unifiedlog"}],"mutable_elements":[{"field":"CrashSignature","description":"Binary crash hash or affected dylib for distinguishing malicious faults from benign ones"},{"field":"InputVector","description":"File, IPC, or network-based input that may be triggering exploitation (e.g., PDF file, POST request)"}],"live":true,"detection_strategies":["DET0304"],"techniques":["T1499.004"]},{"id":"AN0853","stix_id":"x-mitre-analytic--f1aae71a-6460-4c08-9aa7-49743f766a71","name":"Analytic 0853","description":"Cloud workload exploitation leads to repeated container, service, or VM termination/restart, typically associated with CVE-based crash triggers or fuzzed payloads.","url":"https://attack.mitre.org/detectionstrategies/DET0304#AN0853","platforms":["IaaS"],"log_source_references":[{"name":"AWS:CloudTrail","channel":"TerminateInstances","data_component":"DC0089","data_component_name":"Instance Stop","log_source_slug":"aws-cloudtrail"},{"name":"AWS:CloudWatch","channel":"Repeated crash pattern within container or instance logs","data_component":"DC0038","data_component_name":"Application Log Content","log_source_slug":"aws-cloudwatch"},{"name":"AWS:VPCFlowLogs","channel":"Large volume of malformed or synthetic payloads to application endpoints prior to failure","data_component":"DC0085","data_component_name":"Network Traffic Content","log_source_slug":"aws-vpcflowlogs"}],"mutable_elements":[{"field":"CrashThreshold","description":"Number of repeated crashes or terminations observed before triggering alert"},{"field":"ServiceID","description":"Cloud service name, workload, or container ID to scope alerting"}],"live":true,"detection_strategies":["DET0304"],"techniques":["T1499.004"]}],"live":true,"version":"1.0","techniques":["T1499.004"]}],"sigma_rules":[{"id":"1da8ce0b-855d-4004-8860-7d64d42063b1","title":"Apache Segmentation Fault","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2017-02-28","modified":"2021-11-27","description":"Detects a segmentation fault error message caused by a crashing apache worker process","references":["http://www.securityfocus.com/infocus/1633"],"logsource":{"service":"apache"},"tags":["attack.impact","attack.t1499.004"],"path":"rules/web/product/apache/web_apache_segfault.yml","techniques":["T1499.004"],"cves":[]},{"id":"48d91a3a-2363-43ba-a456-ca71ac3da5c2","title":"Audit CVE Event","author":"Florian Roth (Nextron Systems), Zach Mathis","status":"test","level":"critical","date":"2020-01-15","modified":"2022-10-22","description":"Detects events generated by user-mode applications when they call the CveEventWrite API when a known vulnerability is trying to be exploited.\nMS started using this log in Jan. 2020 with CVE-2020-0601 (a Windows CryptoAPI vulnerability.\nUnfortunately, that is about the only instance of CVEs being written to this log.\n","references":["https://twitter.com/VM_vivisector/status/1217190929330655232","https://twitter.com/DidierStevens/status/1217533958096924676","https://twitter.com/FlemmingRiis/status/1217147415482060800","https://www.youtube.com/watch?v=ebmW42YYveI","https://nullsec.us/windows-event-log-audit-cve/"],"logsource":{"product":"windows","service":"application"},"tags":["attack.execution","attack.stealth","attack.t1203","attack.privilege-escalation","attack.t1068","attack.t1211","attack.credential-access","attack.t1212","attack.lateral-movement","attack.t1210","attack.impact","attack.t1499.004"],"path":"rules/windows/builtin/application/microsoft-windows_audit_cve/win_audit_cve.yml","techniques":["T1203","T1068","T1211","T1212","T1210","T1499.004"],"cves":[]},{"id":"59ec40bb-322e-40ab-808d-84fa690d7e56","title":"Nginx Core Dump","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2021-05-31","modified":"2023-05-08","description":"Detects a core dump of a crashing Nginx worker process, which could be a signal of a serious problem or exploitation attempts.","references":["https://docs.nginx.com/nginx/admin-guide/monitoring/debugging/#enabling-core-dumps","https://www.x41-dsec.de/lab/advisories/x41-2021-002-nginx-resolver-copy/"],"logsource":{"service":"nginx"},"tags":["attack.impact","attack.t1499.004"],"path":"rules/web/product/nginx/web_nginx_core_dump.yml","techniques":["T1499.004"],"cves":[]}],"kev_cves":[{"cveID":"CVE-2025-27363","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2015-3043","state":"mapped","mapping_types":["primary_impact"]}],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}