Detect Endpoint Denial of Service in Elastic Security
Adversaries may perform Endpoint Denial of Service (DoS) attacks to degrade or block the availability of services to users. Endpoint DoS can be performed by exhausting system resources (CPU, memory, disk, network connections) or exploiting the system to cause a persistent crash condition. Unlike network-saturating DDoS, Endpoint DoS targets the application stack layers hosted on the victim system — including OS, web servers, DNS, databases, and web applications. Attackers may use IP spoofing, botnets, or direct tools such as hping3, stress-ng, Apache Bench, and custom scripts to generate floods. Observed threat actors include Sandworm Team (disrupting Georgian government websites) and ZxShell malware (SYN flood capability). This detection covers the execution of known DoS tools, abnormal network connection volume from single processes, and resource exhaustion indicators.
MITRE ATT&CK
- Tactic
- Impact
- Technique
- T1499 Endpoint Denial of Service
- Canonical reference
- https://attack.mitre.org/techniques/T1499/
Elastic Detection Query
// Detection 1: Known DoS tool execution
any where (
event.category == "process" and event.type == "start" and (
process.name in ("hping3", "hping", "stress-ng", "stress", "memtester", "ab", "siege", "wrk", "wrk2", "slowloris", "loic", "hoic", "goldeneye", "hulk", "pyloris", "rudy", "xerxes", "torshammer", "mz", "ncrack", "thc-ssl-dos") or
process.args in ("--flood", "--syn", "--icmp") or
process.command_line like "*--flood*" or
process.command_line like "*stress --cpu*" or
process.command_line like "*stress-ng --cpu*" or
process.command_line like "*stress-ng --vm*" or
process.command_line like "*stress-ng --sock*" or
process.command_line like "*:(){ :|:*" or
process.command_line like "*-c 10000*" or
process.command_line like "*--concurrency 5000*"
)
)
// Detection 2: Network flood — sequence of high outbound connection counts
// Use aggregation query for flood detection:
// sequence by host.name, process.name with maxspan=10m
// [network where event.type == "connection_attempted"] with runs=500
// Note: Run as aggregation EQL or use ES|QL for threshold-based:
// FROM logs-endpoint.events.network-*
// | WHERE event.type == "connection_attempted"
// | STATS conn_count = COUNT(*), unique_ips = COUNT_DISTINCT(destination.ip) BY host.name, process.name, process.command_line
// | WHERE conn_count > 500
// Detection 3: Process spawn exhaustion
// FROM logs-endpoint.events.process-*
// | WHERE event.type == "start"
// | STATS proc_count = COUNT(*), unique_exe = COUNT_DISTINCT(process.name) BY host.name, process.parent.name, process.parent.command_line
// | WHERE proc_count > 200 AND unique_exe < 3Detects Endpoint Denial of Service activity via three complementary approaches: (1) execution of known DoS tools such as hping3, stress-ng, LOIC, siege, and wrk by process name or command-line argument patterns; (2) abnormal outbound network connection volume from a single process exceeding 500 connections within 10 minutes indicating a potential flood attack; and (3) rapid process spawning where a single parent spawns more than 200 child processes with fewer than 3 unique executables within 5 minutes, indicating a fork bomb or process exhaustion attack. Maps to MITRE ATT&CK T1499.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate load testing by QA or performance teams using tools like Apache Bench (ab), siege, or wrk against internal staging environments
- System administrators running stress-ng or memtester to diagnose hardware issues or validate new server deployments
- CI/CD pipeline performance benchmarking jobs that spin up multiple short-lived worker processes rapidly, triggering the process spawn threshold
Other platforms for T1499
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1CPU Exhaustion with stress-ng (Linux)
Expected signal: Sysmon for Linux Event ID 1 (Process Create): Image=/usr/bin/stress-ng, CommandLine contains '--cpu 0 --cpu-load 100'. Linux audit log (execve syscall): stress-ng invocation. /proc/loadavg will show load equal to number of CPU cores during test window. System CPU utilization in monitoring tools should spike to 100%.
- Test 2HTTP Flood Simulation with Apache Bench (Windows/Linux)
Expected signal: Sysmon Event ID 1: Image=ab.exe, CommandLine contains '-n 50000 -c 500'. Sysmon Event ID 3: Rapid outbound connections to 127.0.0.1:80. NetworkFlood branch will aggregate these into the 10-minute bucket. Windows Firewall log entries for loopback connections may appear if firewall logging is enabled.
- Test 3SYN Flood Simulation with hping3 (Linux — requires root)
Expected signal: Sysmon for Linux Event ID 1: Image=/usr/sbin/hping3, CommandLine contains '--syn --rand-source --flood'. Linux audit log: execve syscall for hping3 with full arguments. Network statistics: netstat or ss will show spike in SYN connections on the loopback interface. /proc/net/tcp will show many half-open connections.
- Test 4Fork Bomb Execution — Limited Variant (Linux)
Expected signal: Sysmon for Linux Event ID 1: 50+ Process Create events from the same parent bash PID within seconds, all spawning 'sleep' processes. ProcessSpawnExhaustion bucket will accumulate ProcessCount=50+ with UniqueExecutables=1 (sleep). Parent process command line contains the for loop.
References (12)
- https://attack.mitre.org/techniques/T1499/
- https://attack.mitre.org/techniques/T1499/001/
- https://attack.mitre.org/techniques/T1499/002/
- https://attack.mitre.org/techniques/T1499/003/
- https://attack.mitre.org/techniques/T1499/004/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1499/T1499.md
- https://www.cisa.gov/sites/default/files/publications/Understanding-and-Responding-to-Distributed-Denial-of-Service-Attacks.pdf
- https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/netflow/configuration/15-mt/nf-15-mt-book/nf-detct-analy-thrts.pdf
- https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/the-continued-rise-of-ddos-attacks.pdf
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-devicenetworkevents-table
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-deviceprocessevents-table
- https://github.com/SigmaHQ/sigma/tree/master/rules/windows/network_connection
Unlock Pro Content
Get the full detection package for T1499 including response playbook, investigation guide, and atomic red team tests.