AN1165
Analytic 1165
Windows
Repeated invocation of high-resource application endpoints or GUI components causing CPU and memory spikes, logged as elevated request volumes, prolonged handle locks, or frequent crash recoveries.
WinEventLog:Application
High-frequency errors or hangs from resource-intensive application components (e.g., .NET, IIS, Office Suite)
WinEventLog:Sysmon
EventCode=1
Windows:perfmon
Sudden spikes in CPU/Memory usage linked to specific application processes
[CPUThreshold]
Define what percentage of CPU usage indicates abnormal behavior.
[MemoryConsumptionWindow]
Window (e.g., 5 mins) during which sustained memory usage may be abnormal.
[AppCrashFrequency]
Threshold for frequency of application faults within a specific interval.
AN1166
Analytic 1166
Linux
Automated scripts or repeated CLI/API requests that trigger application backends to consume high CPU or memory (e.g., Apache/PHP, MySQL, mail servers), resulting in syslog errors and excessive process spawning.
auditd:SYSCALL
execve
linux:syslog
Error/warning logs from services indicating load spike or worker exhaustion
NSM:Flow
Sustained abnormal inbound request rate targeting application ports (e.g., 80/443/25)
[SyslogErrorRate]
Defines number of critical errors in logs within time window.
[PortRequestSpikeThreshold]
Spike rate on monitored service port triggering alert.
[ProcessSpawnRate]
Rate of process creation that may overwhelm the system.
AN1167
Analytic 1167
macOS
Repetitive triggering of GUI or backend application workflows that cause increased CPU/memory usage, logged in unified logs as spin reports or crash dumps.
macos:unifiedlog
Application errors or resource contention from excessive frontend or script invocation
macos:osquery
Rapid spawning of resource-heavy applications (e.g., Preview, Safari, Office)
[SpinReportCount]
Threshold for number of system spin/crash reports in a defined window.
[HeavyAppReopenRate]
Frequency of user or script reopening GUI-heavy apps.
AN1168
Analytic 1168
IaaS
Automated abuse of cloud-hosted applications (e.g., web apps, REST endpoints, internal APIs) causing compute exhaustion, high 5xx error rates, or frequent autoscaling triggers logged in app insights or cloudwatch.
AWS:CloudWatch
Elevated 5xx response rates in application logs or gateway layer
AWS:CloudTrail
InvokeFunction
AWS:CloudMetrics
Autoscaling, memory/cpu alarms, or instance unhealthiness
[HTTP5xxRateThreshold]
Ratio of 5xx error codes over requests indicating resource exhaustion.
[FunctionInvocationRate]
Spike in lambda/API gateway executions indicating scripted behavior.
[AutoscaleEventCount]
Triggers linked to app DoS where legitimate scaling is mimicked.