Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in User Guide
Log in Get started
Detection Strategies DET0356 — Endpoint DoS via OS Exhaustion Flood Detection Strategy
DET0356

Endpoint DoS via OS Exhaustion Flood Detection Strategy

3 analytic(s) · 1 technique(s) detected

Analytics

3
AN1012 Analytic 1012
Windows

Burst of incomplete TCP handshakes (e.g., SYN floods) or uncorrelated ACK packets targeting the state table resulting in OS resource exhaustion.

WinEventLog:Sysmon EventCode=1 WinEventLog:Microsoft-Windows-TCPIP Connection queue overflow or failure to allocate TCP state object NSM:Firewall High rate of inbound TCP SYN or ACK packets with missing 3-way handshake completion
[TimeWindow] Threshold for burst traffic over short period (e.g., 30s - 2min)
[ConnectionRateThreshold] SYN/ACK packet rate threshold that triggers investigation
[ProcessParentCheck] Whether parent process of flooding tool is a known admin shell or unexpected context
AN1013 Analytic 1013
Linux

Flood of spoofed SYN or ACK packets causing exhaustion of OS TCP state table, potentially via user-space utilities or kernel-level DoS agents.

auditd:SYSCALL Invocation of packet generation tools (e.g., hping3, nping) or fork bombs NSM:Flow High volumes of SYN/ACK packets with unacknowledged TCP handshakes NSM:Flow TCP: possible SYN flood or backlog limit exceeded
[AmplificationThreshold] Volume of fake TCP requests before OS begins degradation
[Interface] Which network interface is being targeted or impacted
AN1014 Analytic 1014
macOS

Adversary tool/script issuing mass SYN/ACK floods that degrade OS responsiveness and interrupt service response on macOS endpoints.

macos:unifiedlog network stack resource exhaustion, tcp_accept queue overflow, repeated resets macos:osquery Execution of flooding tools or compiled packet generators NSM:Firewall Anomalous TCP SYN or ACK spikes from specific source or interface
[SystemLoadThreshold] Observed CPU/network degradation level that triggers response
[ToolExecutionPath] Where DoS tools are commonly dropped or compiled

Detected Techniques

1

Details

MITRE ID
DET0356
STIX ID
x-mitre-detection-strategy--bdf67026-8adb-41da-9a58-c9acba4da1f3
Analytics
3
Techniques Detected
1
By Tactic
Impact
1
Leaving Threaticon

This link opens an external site that isn't part of the platform.