Detect Service Exhaustion Flood in Google Chronicle

rule t1499_002_service_exhaustion_flood_http {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects T1499.002 Service Exhaustion Flood: HTTP flood attacks characterized by high request volume from a single source IP against a web server over a 5-minute window. Covers single-resource floods, simple floods, and service degradation patterns."
    mitre_attack_tactic = "Impact"
    mitre_attack_technique = "T1499.002"
    severity = "HIGH"
    priority = "HIGH"
    version = "1.0"
    created = "2026-04-19"
    platforms = "Windows, Linux, GCP, AWS"

  events:
    // Web access log events — HTTP requests
    $e.metadata.event_type = "NETWORK_HTTP"
    $e.principal.ip != ""
    $e.target.hostname != ""

    // Capture fields for aggregation
    $src_ip = $e.principal.ip
    $target_host = $e.target.hostname
    $status_code = $e.network.http.response_code
    $uri = $e.target.url

  match:
    $src_ip, $target_host over 5m

  outcome:
    $total_requests = count($e.metadata.id)
    $unique_uris = count_distinct($uri)
    $status_5xx_count = sum(if($status_code >= 500, 1, 0))
    $status_429_count = sum(if($status_code = 429, 1, 0))
    $requests_per_second = math.round(count($e.metadata.id) / 300.0, 2)
    $flood_type = if(
      count_distinct($uri) = 1 and count($e.metadata.id) > 500,
        "Single-Resource HTTP Flood",
      if(
        count($e.metadata.id) > 1000 and sum(if($status_code >= 500, 1, 0)) > 100,
          "Service Degradation via HTTP Flood",
        "HTTP Request Flood"
      )
    )
    $risk_score = if(
      count($e.metadata.id) > 2000 or sum(if($status_code >= 500, 1, 0)) > 500, 95,
      if(
        count($e.metadata.id) > 1000 or sum(if($status_code >= 500, 1, 0)) > 200, 75,
        55
      )
    )

  condition:
    #e > 500 or $status_5xx_count > 100
}

rule t1499_002_service_exhaustion_flood_network_alerts {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects T1499.002 Service Exhaustion Flood via network security alerts (firewall, IDS/IPS) reporting flood, DoS, SSL renegotiation, or connection exhaustion events from a single source."
    mitre_attack_tactic = "Impact"
    mitre_attack_technique = "T1499.002"
    severity = "HIGH"
    priority = "HIGH"
    version = "1.0"
    created = "2026-04-19"

  events:
    // Network security device alerts
    $alert.metadata.event_type = "NETWORK_CONNECTION" or
    $alert.metadata.event_type = "GENERIC_EVENT"
    $alert.metadata.product_event_type != ""

    // Match flood/DoS related signatures
    (
      re.regex($alert.metadata.description, `(?i)(flood|denial.of.service|ssl.renegotiation|connection.limit|http.flood|dos.attack|rate.limit)`) or
      re.regex($alert.metadata.product_event_type, `(?i)(flood|dos|renegotiation|conn.limit|syn.flood)`) or
      re.regex($alert.security_result.summary, `(?i)(flood|denial|dos|renegotiation|exhaustion)`)
    )

    // High or critical severity network alerts only
    $alert.security_result.severity = "HIGH" or
    $alert.security_result.severity = "CRITICAL"

    $src_ip = $alert.principal.ip
    $dst_ip = $alert.target.ip
    $alert_name = $alert.security_result.summary

  match:
    $src_ip, $dst_ip over 5m

  outcome:
    $alert_count = count($alert.metadata.id)
    $unique_ports = count_distinct($alert.target.port)
    $flood_type = concat("Network_Alert: ", array_first(array_distinct($alert_name)))
    $risk_score = 85

  condition:
    #alert > 5
}