AN0489
Analytic 0489
Windows
High-frequency, repetitive service requests (e.g., HTTP, TLS renegotiation) originating from a single or small set of source IPs targeting endpoint web services or application ports, leading to exhaustion of CPU or memory on targeted Windows services.
WinEventLog:Application
Unexpected spikes in request volume, application-level errors, or thread pool exhaustion in web or API logs
WinEventLog:Sysmon
EventCode=3, 22
Windows:perfmon
Sustained CPU/memory exhaustion by service process (e.g., w3wp.exe)
[TimeWindow]
Defines burst threshold (e.g., 1 min, 5 min) for connection spikes
[TargetServicePort]
Specific ports/services likely to be abused (e.g., 80, 443, 8080)
[CPUThreshold]
Level of sustained CPU usage considered anomalous for a given service
AN0490
Analytic 0490
Linux
Excessive inbound HTTP or TLS connections to services such as Apache or Nginx, causing worker thread exhaustion or segmentation faults.
auditd:SYSCALL
High frequency of accept(), read(), or SSL_read() syscalls tied to nginx/apache processes
NSM:Flow
Sudden spike in incoming flows to web service ports from single/multiple IPs
linux:syslog
Repetitive HTTP 408, 500, or 503 errors logged within short timeframe
[ErrorCodeWindow]
Tunable count of specific HTTP error codes in timeframe
[ConnectionRateThreshold]
Defines number of connections per second considered anomalous
AN0491
Analytic 0491
macOS
Flood of incoming TLS or HTTP(S) connections to macOS-hosted services (e.g., MAMP, Apache), causing high CPU usage and system unresponsiveness.
macos:unifiedlog
Web service process (e.g., httpd) entering crash loop or consuming excessive CPU
macos:unifiedlog
Rapid incoming TLS handshakes or HTTP requests in quick succession
[TLSHandshakeRate]
Number of renegotiations per minute considered suspicious
[ServiceCrashFrequency]
Threshold of crashes before alerting on instability
AN0492
Analytic 0492
IaaS
Automated or scripted HTTP/TLS flooding from one VM or cloud instance against another service, exploiting compute-based billing or exhaustion of service infrastructure.
AWS:CloudTrail
AuthorizeSecurityGroupIngress
AWS:VPCFlowLogs
Unusual volume of inbound packets from single source across short time interval
AWS:CloudWatch
Sustained spike in CPU usage on EC2 instance with web service role
[VPCFlowBurstRate]
Threshold for traffic burst on target service port
[EC2CPUThreshold]
Compute saturation level for alerting (e.g., >90% for 3 minutes)