Detect Endpoint Denial of Service in IBM QRadar
Adversaries may perform Endpoint Denial of Service (DoS) attacks to degrade or block the availability of services to users. Endpoint DoS can be performed by exhausting system resources (CPU, memory, disk, network connections) or exploiting the system to cause a persistent crash condition. Unlike network-saturating DDoS, Endpoint DoS targets the application stack layers hosted on the victim system — including OS, web servers, DNS, databases, and web applications. Attackers may use IP spoofing, botnets, or direct tools such as hping3, stress-ng, Apache Bench, and custom scripts to generate floods. Observed threat actors include Sandworm Team (disrupting Georgian government websites) and ZxShell malware (SYN flood capability). This detection covers the execution of known DoS tools, abnormal network connection volume from single processes, and resource exhaustion indicators.
MITRE ATT&CK
- Tactic
- Impact
- Technique
- T1499 Endpoint Denial of Service
- Canonical reference
- https://attack.mitre.org/techniques/T1499/
QRadar Detection Query
// Detection 1: Known DoS tool execution
SELECT
DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
logsourcename(logsourceid) AS log_source,
sourceip,
username,
"Image" AS process_image,
"CommandLine" AS command_line,
'KnownDoSTool' AS detection_type,
CONCAT('ProcessName=', "Image") AS risk_indicator
FROM events
WHERE
LOGSOURCETYPEID(logsourceid) = 12 /* Sysmon */
AND QIDNAME(qid) = 'Process Create'
AND (
LOWER("Image") ILIKE '%hping3%' OR LOWER("Image") ILIKE '%hping.exe%'
OR LOWER("Image") ILIKE '%stress-ng%' OR LOWER("Image") ILIKE '%memtester%'
OR LOWER("Image") ILIKE '%ab.exe%' OR LOWER("Image") ILIKE '%siege%'
OR LOWER("Image") ILIKE '%wrk.exe%' OR LOWER("Image") ILIKE '%loic%'
OR LOWER("Image") ILIKE '%hoic%' OR LOWER("Image") ILIKE '%goldeneye%'
OR LOWER("Image") ILIKE '%slowloris%' OR LOWER("Image") ILIKE '%torshammer%'
OR LOWER("Image") ILIKE '%ncrack%' OR LOWER("Image") ILIKE '%thc-ssl-dos%'
OR LOWER("CommandLine") ILIKE '%--%flood%'
OR LOWER("CommandLine") ILIKE '%--syn%'
OR LOWER("CommandLine") ILIKE '%stress --cpu%'
OR LOWER("CommandLine") ILIKE '%stress-ng --cpu%'
OR LOWER("CommandLine") ILIKE '%stress-ng --vm%'
OR LOWER("CommandLine") ILIKE '%stress-ng --sock%'
OR LOWER("CommandLine") ILIKE '%:(){ :|:%'
OR LOWER("CommandLine") ILIKE '%-c 10000%'
OR LOWER("CommandLine") ILIKE '%--concurrency 5000%'
)
AND starttime > NOW() - 3600000
UNION ALL
-- Detection 2: Network flood from single process
SELECT
DATEFORMAT(MIN(starttime), 'YYYY-MM-dd HH:mm:ss') AS event_time,
logsourcename(logsourceid) AS log_source,
sourceip,
username,
"Image" AS process_image,
"CommandLine" AS command_line,
'NetworkFlood' AS detection_type,
CONCAT('ConnectionCount=', COUNT(*), ' UniqueDestIPs=', COUNT(DISTINCT destinationip)) AS risk_indicator
FROM events
WHERE
LOGSOURCETYPEID(logsourceid) = 12
AND QIDNAME(qid) = 'Network connection detected'
AND NOT (destinationip ILIKE '10.%' OR destinationip ILIKE '172.16.%'
OR destinationip ILIKE '192.168.%' OR destinationip ILIKE '127.%')
AND starttime > NOW() - 600000
GROUP BY
logsourceid, sourceip, username, "Image", "CommandLine"
HAVING COUNT(*) > 500
UNION ALL
-- Detection 3: Process spawn exhaustion
SELECT
DATEFORMAT(MIN(starttime), 'YYYY-MM-dd HH:mm:ss') AS event_time,
logsourcename(logsourceid) AS log_source,
sourceip,
username,
"ParentImage" AS process_image,
"ParentCommandLine" AS command_line,
'ProcessSpawnExhaustion' AS detection_type,
CONCAT('ProcessCount=', COUNT(*), ' UniqueExe=', COUNT(DISTINCT "Image")) AS risk_indicator
FROM events
WHERE
LOGSOURCETYPEID(logsourceid) = 12
AND QIDNAME(qid) = 'Process Create'
AND starttime > NOW() - 300000
GROUP BY
logsourceid, sourceip, username, "ParentImage", "ParentCommandLine"
HAVING COUNT(*) > 200 AND COUNT(DISTINCT "Image") < 3
ORDER BY event_time DESCIBM QRadar AQL detection for Endpoint Denial of Service (T1499) targeting three attack patterns: known DoS tool execution identified by process image name or command-line arguments, high-volume outbound network connection flooding exceeding 500 connections within 10 minutes from a single process to external IPs, and process spawn exhaustion where a single parent spawns over 200 child processes with fewer than 3 distinct executables within 5 minutes. Queries Sysmon event data ingested via QRadar log sources.
Data Sources
Required Tables
False Positives & Tuning
- Developer or QA workstations running Apache Bench or wrk for legitimate API load testing against development servers, triggering the known tool and network flood rules simultaneously
- Automated build systems or test pipelines using stress-ng to validate container resource limits or Kubernetes pod autoscaling behavior
- Monitoring agents or endpoint security tools that establish high volumes of short-lived network connections during scanning or telemetry collection, exceeding the 500-connection threshold
Other platforms for T1499
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1CPU Exhaustion with stress-ng (Linux)
Expected signal: Sysmon for Linux Event ID 1 (Process Create): Image=/usr/bin/stress-ng, CommandLine contains '--cpu 0 --cpu-load 100'. Linux audit log (execve syscall): stress-ng invocation. /proc/loadavg will show load equal to number of CPU cores during test window. System CPU utilization in monitoring tools should spike to 100%.
- Test 2HTTP Flood Simulation with Apache Bench (Windows/Linux)
Expected signal: Sysmon Event ID 1: Image=ab.exe, CommandLine contains '-n 50000 -c 500'. Sysmon Event ID 3: Rapid outbound connections to 127.0.0.1:80. NetworkFlood branch will aggregate these into the 10-minute bucket. Windows Firewall log entries for loopback connections may appear if firewall logging is enabled.
- Test 3SYN Flood Simulation with hping3 (Linux — requires root)
Expected signal: Sysmon for Linux Event ID 1: Image=/usr/sbin/hping3, CommandLine contains '--syn --rand-source --flood'. Linux audit log: execve syscall for hping3 with full arguments. Network statistics: netstat or ss will show spike in SYN connections on the loopback interface. /proc/net/tcp will show many half-open connections.
- Test 4Fork Bomb Execution — Limited Variant (Linux)
Expected signal: Sysmon for Linux Event ID 1: 50+ Process Create events from the same parent bash PID within seconds, all spawning 'sleep' processes. ProcessSpawnExhaustion bucket will accumulate ProcessCount=50+ with UniqueExecutables=1 (sleep). Parent process command line contains the for loop.
References (12)
- https://attack.mitre.org/techniques/T1499/
- https://attack.mitre.org/techniques/T1499/001/
- https://attack.mitre.org/techniques/T1499/002/
- https://attack.mitre.org/techniques/T1499/003/
- https://attack.mitre.org/techniques/T1499/004/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1499/T1499.md
- https://www.cisa.gov/sites/default/files/publications/Understanding-and-Responding-to-Distributed-Denial-of-Service-Attacks.pdf
- https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/netflow/configuration/15-mt/nf-15-mt-book/nf-detct-analy-thrts.pdf
- https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/the-continued-rise-of-ddos-attacks.pdf
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-devicenetworkevents-table
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-deviceprocessevents-table
- https://github.com/SigmaHQ/sigma/tree/master/rules/windows/network_connection
Unlock Pro Content
Get the full detection package for T1499 including response playbook, investigation guide, and atomic red team tests.