Detect Endpoint Denial of Service in CrowdStrike LogScale
Adversaries may perform Endpoint Denial of Service (DoS) attacks to degrade or block the availability of services to users. Endpoint DoS can be performed by exhausting system resources (CPU, memory, disk, network connections) or exploiting the system to cause a persistent crash condition. Unlike network-saturating DDoS, Endpoint DoS targets the application stack layers hosted on the victim system — including OS, web servers, DNS, databases, and web applications. Attackers may use IP spoofing, botnets, or direct tools such as hping3, stress-ng, Apache Bench, and custom scripts to generate floods. Observed threat actors include Sandworm Team (disrupting Georgian government websites) and ZxShell malware (SYN flood capability). This detection covers the execution of known DoS tools, abnormal network connection volume from single processes, and resource exhaustion indicators.
MITRE ATT&CK
- Tactic
- Impact
- Technique
- T1499 Endpoint Denial of Service
- Canonical reference
- https://attack.mitre.org/techniques/T1499/
LogScale Detection Query
// Detection 1: Known DoS Tool Execution
#event_simpleName=ProcessRollup2
| FileName = /hping3|hping\.exe|stress-ng|memtester|ab\.exe|siege|wrk\.exe|wrk2|loic|hoic|goldeneye|slowloris|torshammer|ncrack|thc-ssl-dos|xerxes|rudy|pyloris|hulk/i
OR CommandLine = /--flood|--syn\s|stress\s--cpu|stress-ng\s--cpu|stress-ng\s--vm|stress-ng\s--sock|:\(\)\{\s:\|:|-c\s10000|--concurrency\s5000/i
| groupBy([ComputerName, UserName, FileName, CommandLine, ParentBaseFileName],
function=[
count(as=EventCount),
selectLast(ParentCommandLine),
selectLast(timestamp, as=LastSeen)
]
)
| DetectionType := "KnownDoSTool"
| RiskIndicator := format("Process=%s | Args=%s", field=FileName, field=CommandLine)
| sort(LastSeen, order=desc)
// Detection 2: Network Flood — high outbound connection count from a single process
// (run as separate query)
// #event_simpleName=NetworkConnectIP4
// | LocalAddressIP4 != /^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|127\.)/
// | groupBy([ComputerName, ImageFileName, UserName],
// function=[
// count(as=ConnectionCount),
// count(RemoteAddressIP4, distinct=true, as=UniqueDestIPs),
// count(RemotePort, distinct=true, as=UniqueDestPorts)
// ],
// limit=max,
// start=now()-10min
// )
// | ConnectionCount > 500
// | DetectionType := "NetworkFlood"
// | RiskIndicator := format("ConnectionCount=%s UniqueIPs=%s", field=ConnectionCount, field=UniqueDestIPs)
// | sort(ConnectionCount, order=desc)
// Detection 3: Process Spawn Exhaustion
// (run as separate query)
// #event_simpleName=ProcessRollup2
// | groupBy([ComputerName, ParentBaseFileName, UserName],
// function=[
// count(as=ProcessCount),
// count(FileName, distinct=true, as=UniqueExecutables),
// collect(FileName, max=10, as=SpawnedExecutables)
// ],
// limit=max,
// start=now()-5min
// )
// | ProcessCount > 200 AND UniqueExecutables < 3
// | DetectionType := "ProcessSpawnExhaustion"
// | RiskIndicator := format("ProcessCount=%s UniqueExe=%s", field=ProcessCount, field=UniqueExecutables)
// | sort(ProcessCount, order=desc)CrowdStrike LogScale (Falcon) detection for Endpoint Denial of Service (T1499) using Falcon telemetry. Three detection branches: (1) ProcessRollup2 events matching known DoS tool file names (hping3, stress-ng, LOIC, siege, etc.) or flood/stress command-line arguments using LogScale regex matching, grouped by host and process for deduplication; (2) NetworkConnectIP4 events aggregated over 10 minutes to detect processes generating more than 500 outbound connections to external IPs from a single process, indicating a network flood; (3) ProcessRollup2 events aggregated over 5 minutes to detect single-parent process spawning more than 200 children with fewer than 3 distinct executable names, indicating a fork bomb or process exhaustion attack. All detections leverage CrowdStrike Falcon's native EDR telemetry without requiring additional log sources.
Data Sources
Required Tables
False Positives & Tuning
- IT operations teams running wrk or Apache Bench (ab) against internal web servers for capacity planning or pre-deployment performance validation, matching both tool name and connection volume rules
- Security tooling such as vulnerability scanners or asset inventory agents that enumerate services via high-volume short-lived TCP connections, exceeding the 500-connection threshold
- Containerized workloads or serverless function runners (Lambda emulators, Docker-in-Docker) that spawn many identical worker container processes in rapid succession, triggering the process spawn exhaustion rule with low unique executable diversity
Other platforms for T1499
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1CPU Exhaustion with stress-ng (Linux)
Expected signal: Sysmon for Linux Event ID 1 (Process Create): Image=/usr/bin/stress-ng, CommandLine contains '--cpu 0 --cpu-load 100'. Linux audit log (execve syscall): stress-ng invocation. /proc/loadavg will show load equal to number of CPU cores during test window. System CPU utilization in monitoring tools should spike to 100%.
- Test 2HTTP Flood Simulation with Apache Bench (Windows/Linux)
Expected signal: Sysmon Event ID 1: Image=ab.exe, CommandLine contains '-n 50000 -c 500'. Sysmon Event ID 3: Rapid outbound connections to 127.0.0.1:80. NetworkFlood branch will aggregate these into the 10-minute bucket. Windows Firewall log entries for loopback connections may appear if firewall logging is enabled.
- Test 3SYN Flood Simulation with hping3 (Linux — requires root)
Expected signal: Sysmon for Linux Event ID 1: Image=/usr/sbin/hping3, CommandLine contains '--syn --rand-source --flood'. Linux audit log: execve syscall for hping3 with full arguments. Network statistics: netstat or ss will show spike in SYN connections on the loopback interface. /proc/net/tcp will show many half-open connections.
- Test 4Fork Bomb Execution — Limited Variant (Linux)
Expected signal: Sysmon for Linux Event ID 1: 50+ Process Create events from the same parent bash PID within seconds, all spawning 'sleep' processes. ProcessSpawnExhaustion bucket will accumulate ProcessCount=50+ with UniqueExecutables=1 (sleep). Parent process command line contains the for loop.
References (12)
- https://attack.mitre.org/techniques/T1499/
- https://attack.mitre.org/techniques/T1499/001/
- https://attack.mitre.org/techniques/T1499/002/
- https://attack.mitre.org/techniques/T1499/003/
- https://attack.mitre.org/techniques/T1499/004/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1499/T1499.md
- https://www.cisa.gov/sites/default/files/publications/Understanding-and-Responding-to-Distributed-Denial-of-Service-Attacks.pdf
- https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/netflow/configuration/15-mt/nf-15-mt-book/nf-detct-analy-thrts.pdf
- https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/the-continued-rise-of-ddos-attacks.pdf
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-devicenetworkevents-table
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-deviceprocessevents-table
- https://github.com/SigmaHQ/sigma/tree/master/rules/windows/network_connection
Unlock Pro Content
Get the full detection package for T1499 including response playbook, investigation guide, and atomic red team tests.