AN0584
Analytic 0584
Windows
Excessive resource exhaustion or service crash induced by processes launched by users or scripts that rapidly consume CPU/memory or attempt malformed service interactions.
WinEventLog:Sysmon
EventCode=1
WinEventLog:Application
Service crash, unhandled exception, or application hang warnings for critical services (e.g., IIS, DNS, SQL Server)
WinEventLog:System
System shutdowns due to bugcheck (Event ID 1001) or watchdog timer expirations
[TimeWindow]
Number of service crashes or high-CPU events within a defined time period
[ServiceTarget]
Specific service name or executable targeted for DoS (e.g., svchost.exe, w3wp.exe)
[CPUThresholdPercent]
CPU usage percent considered anomalous over duration
AN0585
Analytic 0585
Linux
Malicious script or binary causes repeated kernel panics, OOM kills, or systemd service restarts targeting services like nginx, httpd, sshd.
auditd:SYSCALL
execve
linux:syslog
Out of memory killer invoked or kernel panic entries
journald:systemd
Repeated service restart attempts or unit failures
[ServiceName]
Targeted daemon/service such as sshd, nginx, mysql
[RestartThreshold]
Number of restarts in short succession to trigger alert
[OOMKillCount]
Count of OOM kills over a time window
AN0586
Analytic 0586
macOS
Adversary launches high-entropy process or malformed app bundle causing repeated application crashes and system slowdowns.
macos:unifiedlog
Repeated process crashes logged by CrashReporter or system instability logs in com.apple.console
macos:unifiedlog
Spike in CPU or memory use from non-user-initiated processes
[CrashCountThreshold]
Number of app crashes within monitoring window
[PayloadEntropyThreshold]
Used for high-entropy binaries often observed in DoS malware samples
AN0587
Analytic 0587
IaaS
Instance enters degraded/unhealthy state due to abnormal process load or memory exhaustion, often caused by automation or script-based attacks.
AWS:CloudWatch
StatusCheckFailed or StatusCheckFailed_System for burstable instances (t2/t3)
AWS:CloudTrail
StartInstances
VPCFlowLogs:All
High volume internal traffic with low entropy indicating looped or malicious DoS script
[InstanceType]
Burstable vs compute-optimized instances impact DoS effect
[FailureThreshold]
How many consecutive StatusCheckFailed events to consider critical
AN0588
Analytic 0588
Containers
Container orchestrator logs show crashlooping pods, repeated resource exhaustion, or malicious binaries with infinite loops consuming systemd/cgroup limits.
kubernetes:events
CrashLoopBackOff, OOMKilled, container restart count exceeds threshold
docker:events
Container exited with non-zero code repeatedly in short period
[RestartCountThreshold]
Number of container restarts within a time window
[ContainerImageEntropy]
Payload entropy of container image as an anomaly factor