T1499.001 OS Exhaustion Flood

impact — Linux, macOS, Windows · attack.mitre.org · JSON

MITRE detection strategy

analytics

Sigma rules tagged attack.t1499.001

KEV CVEs mapped here

Adversaries may launch a denial of service (DoS) attack targeting an endpoint's operating system (OS). A system's OS is responsible for managing the finite resources as well as preventing the entire system from being overwhelmed by excessive demands on its capacity. These attacks do not need to exhaust the actual resources on a system; the attacks may simply exhaust the limits and available resources that an OS self-imposes.Different ways to achieve this exist, including TCP state-exhaustion attacks such as SYN floods and ACK floods. With SYN floods, excessive amounts of SYN packets are sent, but the 3-way TCP handshake is never completed. Because each OS has a maximum number of concurrent TCP connections that it will allow, this can quickly exhaust the ability of the system to receive new requests for TCP connections, thus preventing access to any TCP service provided by the server.ACK floods leverage the stateful nature of the TCP protocol. A flood of ACK packets are sent to the target. This forces the OS to search its state table for a related TCP connection that has already been established. Because the ACK packets are for connections that do not exist, the OS will have to search the entire state table to confirm that no match exists. When it is necessary to do this for a large flood of packets, the computational requirements can cause the server to become sluggish and/or unresponsive, due to the work it must do to eliminate the rogue ACK packets. This greatly reduces the resources available for providing the targeted service.

KEV CVEs mapped to this technique · CTID Mappings Explorer

None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.

Detection strategy · ATT&CK Enterprise v19.2

DET0356 Endpoint DoS via OS Exhaustion Flood Detection Strategy v1.0
AN1012 Windows
Burst of incomplete TCP handshakes (e.g., SYN floods) or uncorrelated ACK packets targeting the state table resulting in OS resource exhaustion.

WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation
WinEventLog:Microsoft-Windows-TCPIP Connection queue overflow or failure to allocate TCP state object → DC0018 Host Status
NSM:Firewall High rate of inbound TCP SYN or ACK packets with missing 3-way handshake completion → DC0085 Network Traffic Content

Tunable: TimeWindow ConnectionRateThreshold ProcessParentCheck

AN1013 Linux
Flood of spoofed SYN or ACK packets causing exhaustion of OS TCP state table, potentially via user-space utilities or kernel-level DoS agents.

auditd:SYSCALL Invocation of packet generation tools (e.g., hping3, nping) or fork bombs → DC0032 Process Creation
NSM:Flow High volumes of SYN/ACK packets with unacknowledged TCP handshakes → DC0078 Network Traffic Flow
NSM:Flow TCP: possible SYN flood or backlog limit exceeded → DC0018 Host Status

Tunable: AmplificationThreshold Interface

AN1014 macOS
Adversary tool/script issuing mass SYN/ACK floods that degrade OS responsiveness and interrupt service response on macOS endpoints.

macos:unifiedlog network stack resource exhaustion, tcp_accept queue overflow, repeated resets → DC0018 Host Status
macos:osquery Execution of flooding tools or compiled packet generators → DC0032 Process Creation
NSM:Firewall Anomalous TCP SYN or ACK spikes from specific source or interface → DC0085 Network Traffic Content

Tunable: SystemLoadThreshold ToolExecutionPath

Sigma rules · SigmaHQ da9bb07d64, tag `attack.t1499.001`

NTFS Vulnerability Exploitation hightest

Author: Florian Roth (Nextron Systems) · 2021-01-11 (modified 2022-12-25) · logsource: product=windows service=system · f14719ce-d3ab-4e25-9ce6-2899092260b0

This the exploitation of a NTFS vulnerability as reported without many details via Twitter

Techniques: T1499.001

Rules tagged at the parent level (attack.t1499) 3

These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.

CVE-2024-49113 Exploitation Attempt - LDAP Nightmare highexperimental

Author: Samuel Monsempes · 2025-01-08 · logsource: product=windows service=application · 3f2c93c7-7b2a-4d58-bb8d-6f39422d8148

Detects exploitation attempt of CVE-2024-49113 known as LDAP Nightmare, based on "Application Error" log where the faulting application is "lsass.exe" and the faulting module is "WLDAP32.dll".

Techniques: T1499

CVE tags: CVE-2024-49113

Potential Abuse of Linux Magic System Request Key mediumexperimental

Author: Milad Cheraghi · 2025-05-23 · logsource: product=linux service=auditd · ea61bb82-a5e0-42e6-8537-91d29500f1b9

Detects the potential abuse of the Linux Magic SysRq (System Request) key by adversaries with root or sufficient privileges to silently manipulate or destabilize a system. By writing to /proc/sysrq-trigger, they can crash the system, kill processes, or disrupt forensic analysis—all while bypassing standard logging. Though intended for recovery and debugging, SysRq can be misused as a stealthy post-exploitation tool. It is controlled via /proc/sys/kernel/sysrq or permanently through /etc/sysctl.conf.

Techniques: T1059.004 T1529 T1489 T1499

LSASS Crash Via Netlogon Stack Buffer Overflow - CVE-2026-41089 highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2026-06-02 · logsource: product=windows service=application · f8a66a02-4a16-46e5-b7fd-a42c8a93d137

Detects a crash of the LSASS process where netlogon.dll is the faulting module and the exception code is STATUS_STACK_BUFFER_OVERRUN (0xc0000409). This crash, especially on Domain Controllers, might indicate the exploitation of CVE-2026-41089, a denial of service (DoS) vulnerability, which exists in the Netlogon component of Windows and can be triggered by sending specially crafted requests to the Netlogon service, leading to a stack-based buffer overflow and subsequent crash of the LSASS process.