Endpoint Denial of Service: Application or System Exploitation
- ID
- T1499.004
- Tactics
- TA0040 Impact
- Sub-technique of
- T1499 Endpoint Denial of Service
- Platforms
- Windows, IaaS, Linux, macOS
- Data sources
- Application Log Content, Process Creation, Service Creation, Process Termination, Network Traffic Content, Instance Stop
- Source
- attack.mitre.org
- MITRE last modified
- 25 Oct 2025
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users. [2] Some systems may automatically restart critical applications and services when crashes occur, but they can likely be re-exploited to cause a persistent denial of service (DoS) condition.
Adversaries may exploit known or zero-day vulnerabilities to crash applications and/or systems, which may also lead to dependent applications and/or systems to be in a DoS condition. Crashed or restarted applications or systems may also have other effects such as Data Destruction, Firmware Corruption, Service Stop etc. which may further cause a DoS condition and deny availability to critical information, applications and/or systems.
Detection
- DET0304 Detection Strategy for Endpoint DoS via Application or System Exploitation
Data components: Application Log Content, Process Creation, Service Creation, Process Termination, Network Traffic Content, Instance Stop
Mitigations (1)
- M1037 Filter Network Traffic
Leverage services provided by Content Delivery Networks (CDN) or providers specializing in DoS mitigations to filter traffic upstream from services.[1] Filter boundary traffic by blocking source addresses sourcing the attack, blocking ports that are being targeted, or blocking protocols being used for transport.
Software (1)
References
- CERT-EU DDoS March 2017
- Sucuri BIND9 August 2015