Detect Endpoint Denial of Service in Google Chronicle

rule endpoint_dos_tool_execution {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects execution of known Endpoint DoS tools or command patterns associated with MITRE ATT&CK T1499"
    severity = "HIGH"
    mitre_attack_tactic = "Impact"
    mitre_attack_technique = "T1499"
    reference = "https://attack.mitre.org/techniques/T1499/"
    created = "2026-04-19"
  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    (
      re.regex($e.principal.process.file.full_path, `(?i)(hping3|hping\.exe|stress-ng|memtester|ab\.exe|siege\.exe|wrk\.exe|wrk2|loic\.exe|hoic\.exe|goldeneye|slowloris|torshammer|ncrack|thc-ssl-dos|xerxes|rudy|pyloris|hulk)`) or
      re.regex($e.target.process.command_line, `(?i)(--flood|--syn\s|stress\s--cpu|stress-ng\s--cpu|stress-ng\s--vm|stress-ng\s--sock|:\(\)\{\s:\|:|fork bomb|-c\s10000|--concurrency\s5000)`) or
      re.regex($e.target.process.file.full_path, `(?i)(hping3|hping\.exe|stress-ng|memtester|ab\.exe|siege\.exe|wrk\.exe|loic\.exe|hoic\.exe|goldeneye|slowloris|torshammer|ncrack|thc-ssl-dos)`)
    )
  condition:
    $e
}

rule endpoint_dos_network_flood {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects abnormal outbound network connection volume from a single process indicating a potential DoS flood attack — T1499"
    severity = "HIGH"
    mitre_attack_tactic = "Impact"
    mitre_attack_technique = "T1499"
    reference = "https://attack.mitre.org/techniques/T1499/"
    created = "2026-04-19"
  events:
    $e.metadata.event_type = "NETWORK_CONNECTION"
    $e.network.direction = "OUTBOUND"
    not re.regex($e.target.ip, `^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|127\.)`)
    $hostname = $e.principal.hostname
    $proc = $e.principal.process.file.full_path
  match:
    $hostname, $proc over 10m
  outcome:
    $connection_count = count_distinct($e.metadata.id)
    $unique_dest_ips = count_distinct($e.target.ip)
    $unique_dest_ports = count_distinct($e.target.port)
    $risk_indicator = array_distinct($e.target.ip)
  condition:
    #e > 500
}

rule endpoint_dos_process_exhaustion {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects rapid process spawning from a single parent indicative of fork bomb or process exhaustion attack — T1499"
    severity = "CRITICAL"
    mitre_attack_tactic = "Impact"
    mitre_attack_technique = "T1499"
    reference = "https://attack.mitre.org/techniques/T1499/"
    created = "2026-04-19"
  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    $parent_proc = $e.principal.process.file.full_path
    $hostname = $e.principal.hostname
    $child_exe = $e.target.process.file.full_path
  match:
    $hostname, $parent_proc over 5m
  outcome:
    $spawn_count = count_distinct($e.metadata.id)
    $unique_child_exe = count_distinct($child_exe)
  condition:
    #e > 200 and $unique_child_exe < 3
}