Detect Endpoint Denial of Service in Microsoft Sentinel
Adversaries may perform Endpoint Denial of Service (DoS) attacks to degrade or block the availability of services to users. Endpoint DoS can be performed by exhausting system resources (CPU, memory, disk, network connections) or exploiting the system to cause a persistent crash condition. Unlike network-saturating DDoS, Endpoint DoS targets the application stack layers hosted on the victim system — including OS, web servers, DNS, databases, and web applications. Attackers may use IP spoofing, botnets, or direct tools such as hping3, stress-ng, Apache Bench, and custom scripts to generate floods. Observed threat actors include Sandworm Team (disrupting Georgian government websites) and ZxShell malware (SYN flood capability). This detection covers the execution of known DoS tools, abnormal network connection volume from single processes, and resource exhaustion indicators.
MITRE ATT&CK
- Tactic
- Impact
- Technique
- T1499 Endpoint Denial of Service
- Canonical reference
- https://attack.mitre.org/techniques/T1499/
KQL Detection Query
let KnownDoSTools = dynamic([
"hping3", "hping", "stress-ng", "stress", "memtester",
"ab.exe", "ab", "siege", "wrk", "wrk2", "slowloris",
"loic", "hoic", "goldeneye", "hulk", "pyloris",
"torsocks", "rudy", "xerxes", "torshammer",
"mz", "ncrack", "thc-ssl-dos"
]);
let DoSCommandPatterns = dynamic([
"--flood", "--syn", "-S --flood", "--icmp --flood",
"stress --cpu", "stress --vm", "stress --io", "stress-ng --cpu",
"stress-ng --vm", "stress-ng --sock", "--workers",
":(){ :|:", "fork bomb",
"-c 10000", "-n 100000", "--concurrency 5000"
]);
let HighConnectionThreshold = 500;
// Detection 1: Known DoS tool execution
let DoSToolExecution =
DeviceProcessEvents
| where Timestamp > ago(1h)
| where FileName has_any (KnownDoSTools)
or ProcessCommandLine has_any (DoSCommandPatterns)
| extend DetectionType = "KnownDoSTool"
| extend RiskIndicator = strcat(FileName, " | ", ProcessCommandLine);
// Detection 2: Abnormal outbound connection volume from a single process (potential flood)
let NetworkFlood =
DeviceNetworkEvents
| where Timestamp > ago(10m)
| where ActionType in ("ConnectionSuccess", "ConnectionRequest", "ConnectionFailed")
| summarize
ConnectionCount = count(),
UniqueDestIPs = dcount(RemoteIP),
UniqueDestPorts = dcount(RemotePort),
Protocols = make_set(Protocol),
EarliestConn = min(Timestamp),
LatestConn = max(Timestamp)
by DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName
| where ConnectionCount > HighConnectionThreshold
| extend DetectionType = "NetworkFlood"
| extend RiskIndicator = strcat("ConnectionCount=", ConnectionCount, " UniqueIPs=", UniqueDestIPs);
// Detection 3: Rapid fork / process spawning (potential fork bomb or process exhaustion)
let ProcessExhaustion =
DeviceProcessEvents
| where Timestamp > ago(5m)
| summarize
ProcessCount = count(),
UniqueExecutables = dcount(FileName),
ParentProcesses = make_set(InitiatingProcessFileName, 5)
by DeviceName, InitiatingProcessFileName, InitiatingProcessAccountName
| where ProcessCount > 200 and UniqueExecutables < 3
| extend DetectionType = "ProcessSpawnExhaustion"
| extend RiskIndicator = strcat("ProcessCount=", ProcessCount, " UniqueExe=", UniqueExecutables);
// Union all detections
DoSToolExecution
| project Timestamp, DeviceName, AccountName=InitiatingProcessAccountName,
DetectionType, FileName, ProcessCommandLine, InitiatingProcessFileName,
InitiatingProcessCommandLine, RiskIndicator
| union (
NetworkFlood
| project
Timestamp=EarliestConn, DeviceName,
AccountName=InitiatingProcessAccountName,
DetectionType,
FileName=InitiatingProcessFileName,
ProcessCommandLine=InitiatingProcessCommandLine,
InitiatingProcessFileName="",
InitiatingProcessCommandLine="",
RiskIndicator
)
| union (
ProcessExhaustion
| project
Timestamp=now(), DeviceName,
AccountName=InitiatingProcessAccountName,
DetectionType,
FileName=InitiatingProcessFileName,
ProcessCommandLine="",
InitiatingProcessFileName="",
InitiatingProcessCommandLine="",
RiskIndicator
)
| sort by Timestamp descMulti-signal detection for Endpoint Denial of Service covering three distinct patterns: (1) Execution of known DoS tools such as hping3, stress-ng, ab, siege, LOIC, and GoldenEye by filename or command-line patterns including --flood, --syn, and high concurrency flags; (2) A single process generating more than 500 outbound network connections within a 10-minute window, indicating application-layer flood behavior; (3) Rapid process spawning where a single parent process creates more than 200 child processes within 5 minutes using fewer than 3 unique executables, indicative of fork bomb or process exhaustion attacks. Results are unioned into a single timeline with a DetectionType field for triage prioritization.
Data Sources
Required Tables
False Positives & Tuning
- Performance testing teams running Apache Bench (ab), wrk, or siege against internal load balancers or staging environments during authorized load tests
- Site reliability engineers running stress-ng or stress on Linux servers to validate autoscaling or hardware under controlled conditions
- Security teams using hping3 for legitimate network diagnostic or firewall rule testing in authorized environments
- High-throughput legitimate services (CDN proxies, load balancers, streaming servers) that maintain large persistent connection pools
- Deployment automation or CI/CD pipeline jobs that spawn many short-lived processes in rapid succession during build or test phases
Other platforms for T1499
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1CPU Exhaustion with stress-ng (Linux)
Expected signal: Sysmon for Linux Event ID 1 (Process Create): Image=/usr/bin/stress-ng, CommandLine contains '--cpu 0 --cpu-load 100'. Linux audit log (execve syscall): stress-ng invocation. /proc/loadavg will show load equal to number of CPU cores during test window. System CPU utilization in monitoring tools should spike to 100%.
- Test 2HTTP Flood Simulation with Apache Bench (Windows/Linux)
Expected signal: Sysmon Event ID 1: Image=ab.exe, CommandLine contains '-n 50000 -c 500'. Sysmon Event ID 3: Rapid outbound connections to 127.0.0.1:80. NetworkFlood branch will aggregate these into the 10-minute bucket. Windows Firewall log entries for loopback connections may appear if firewall logging is enabled.
- Test 3SYN Flood Simulation with hping3 (Linux — requires root)
Expected signal: Sysmon for Linux Event ID 1: Image=/usr/sbin/hping3, CommandLine contains '--syn --rand-source --flood'. Linux audit log: execve syscall for hping3 with full arguments. Network statistics: netstat or ss will show spike in SYN connections on the loopback interface. /proc/net/tcp will show many half-open connections.
- Test 4Fork Bomb Execution — Limited Variant (Linux)
Expected signal: Sysmon for Linux Event ID 1: 50+ Process Create events from the same parent bash PID within seconds, all spawning 'sleep' processes. ProcessSpawnExhaustion bucket will accumulate ProcessCount=50+ with UniqueExecutables=1 (sleep). Parent process command line contains the for loop.
References (12)
- https://attack.mitre.org/techniques/T1499/
- https://attack.mitre.org/techniques/T1499/001/
- https://attack.mitre.org/techniques/T1499/002/
- https://attack.mitre.org/techniques/T1499/003/
- https://attack.mitre.org/techniques/T1499/004/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1499/T1499.md
- https://www.cisa.gov/sites/default/files/publications/Understanding-and-Responding-to-Distributed-Denial-of-Service-Attacks.pdf
- https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/netflow/configuration/15-mt/nf-15-mt-book/nf-detct-analy-thrts.pdf
- https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/the-continued-rise-of-ddos-attacks.pdf
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-devicenetworkevents-table
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-deviceprocessevents-table
- https://github.com/SigmaHQ/sigma/tree/master/rules/windows/network_connection
Unlock Pro Content
Get the full detection package for T1499 including response playbook, investigation guide, and atomic red team tests.