Detect Endpoint Denial of Service in Sumo Logic CSE
Adversaries may perform Endpoint Denial of Service (DoS) attacks to degrade or block the availability of services to users. Endpoint DoS can be performed by exhausting system resources (CPU, memory, disk, network connections) or exploiting the system to cause a persistent crash condition. Unlike network-saturating DDoS, Endpoint DoS targets the application stack layers hosted on the victim system — including OS, web servers, DNS, databases, and web applications. Attackers may use IP spoofing, botnets, or direct tools such as hping3, stress-ng, Apache Bench, and custom scripts to generate floods. Observed threat actors include Sandworm Team (disrupting Georgian government websites) and ZxShell malware (SYN flood capability). This detection covers the execution of known DoS tools, abnormal network connection volume from single processes, and resource exhaustion indicators.
MITRE ATT&CK
- Tactic
- Impact
- Technique
- T1499 Endpoint Denial of Service
- Canonical reference
- https://attack.mitre.org/techniques/T1499/
Sumo Detection Query
// Detection 1: Known DoS Tool Execution
_sourceCategory="windows/sysmon" EventCode=1
| where Image matches "*hping3*" OR Image matches "*hping.exe*"
OR Image matches "*stress-ng*" OR Image matches "*memtester*"
OR Image matches "*ab.exe" OR Image matches "*siege*"
OR Image matches "*wrk.exe*" OR Image matches "*loic*"
OR Image matches "*hoic*" OR Image matches "*goldeneye*"
OR Image matches "*slowloris*" OR Image matches "*torshammer*"
OR Image matches "*ncrack*" OR Image matches "*thc-ssl-dos*"
OR CommandLine matches "*--flood*"
OR CommandLine matches "*--syn*"
OR CommandLine matches "*stress --cpu*"
OR CommandLine matches "*stress-ng --cpu*"
OR CommandLine matches "*stress-ng --vm*"
OR CommandLine matches "*stress-ng --sock*"
OR CommandLine matches "*:(){ :|:*"
OR CommandLine matches "*-c 10000*"
OR CommandLine matches "*--concurrency 5000*"
| fields _messagetime, Computer, User, Image, CommandLine, ParentImage, ParentCommandLine
| concat(Image, " | ", CommandLine) as RiskIndicator
| "KnownDoSTool" as DetectionType
// Detection 2: Network Flood (run as separate query)
// _sourceCategory="windows/sysmon" EventCode=3
// | where !(DestinationIp matches "10.*" OR DestinationIp matches "172.16.*"
// OR DestinationIp matches "192.168.*" OR DestinationIp matches "127.*")
// | timeslice 10m
// | stats count as ConnectionCount, dcount(DestinationIp) as UniqueDestIPs,
// dcount(DestinationPort) as UniqueDestPorts
// by _timeslice, Computer, User, Image, CommandLine
// | where ConnectionCount > 500
// | concat("ConnectionCount=", ConnectionCount, " UniqueIPs=", UniqueDestIPs) as RiskIndicator
// | "NetworkFlood" as DetectionType
// Detection 3: Process Spawn Exhaustion (run as separate query)
// _sourceCategory="windows/sysmon" EventCode=1
// | timeslice 5m
// | stats count as ProcessCount, dcount(Image) as UniqueExecutables,
// values(Image) as SpawnedImages
// by _timeslice, Computer, User, ParentImage, ParentCommandLine
// | where ProcessCount > 200 AND UniqueExecutables < 3
// | concat("ProcessCount=", ProcessCount, " UniqueExe=", UniqueExecutables) as RiskIndicator
// | "ProcessSpawnExhaustion" as DetectionTypeSumo Logic detection for Endpoint Denial of Service (T1499) using Sysmon data ingested via the windows/sysmon source category. Three detection branches address: (1) execution of known DoS and stress-testing tools by process image name or command-line argument patterns including flood flags and fork bomb syntax; (2) network connection flooding from a single process exceeding 500 external connections within a 10-minute time slice; and (3) process spawn exhaustion where a parent process generates over 200 child processes with fewer than 3 distinct executable names within 5 minutes. Queries are structured for individual execution or combination via union in a Sumo Logic scheduled search.
Data Sources
Required Tables
False Positives & Tuning
- Security researchers or red team members running controlled stress tests against isolated lab environments using tools like hping3 or siege, which will match known DoS tool names
- Large-scale web crawlers, scraping jobs, or integration tests that generate high numbers of outbound HTTP connections within short windows, triggering the network flood threshold
- Application servers with a high process fork model (such as pre-fork Apache or uWSGI) that rapidly spawn worker processes on startup or during traffic spikes, triggering the process exhaustion rule
Other platforms for T1499
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1CPU Exhaustion with stress-ng (Linux)
Expected signal: Sysmon for Linux Event ID 1 (Process Create): Image=/usr/bin/stress-ng, CommandLine contains '--cpu 0 --cpu-load 100'. Linux audit log (execve syscall): stress-ng invocation. /proc/loadavg will show load equal to number of CPU cores during test window. System CPU utilization in monitoring tools should spike to 100%.
- Test 2HTTP Flood Simulation with Apache Bench (Windows/Linux)
Expected signal: Sysmon Event ID 1: Image=ab.exe, CommandLine contains '-n 50000 -c 500'. Sysmon Event ID 3: Rapid outbound connections to 127.0.0.1:80. NetworkFlood branch will aggregate these into the 10-minute bucket. Windows Firewall log entries for loopback connections may appear if firewall logging is enabled.
- Test 3SYN Flood Simulation with hping3 (Linux — requires root)
Expected signal: Sysmon for Linux Event ID 1: Image=/usr/sbin/hping3, CommandLine contains '--syn --rand-source --flood'. Linux audit log: execve syscall for hping3 with full arguments. Network statistics: netstat or ss will show spike in SYN connections on the loopback interface. /proc/net/tcp will show many half-open connections.
- Test 4Fork Bomb Execution — Limited Variant (Linux)
Expected signal: Sysmon for Linux Event ID 1: 50+ Process Create events from the same parent bash PID within seconds, all spawning 'sleep' processes. ProcessSpawnExhaustion bucket will accumulate ProcessCount=50+ with UniqueExecutables=1 (sleep). Parent process command line contains the for loop.
References (12)
- https://attack.mitre.org/techniques/T1499/
- https://attack.mitre.org/techniques/T1499/001/
- https://attack.mitre.org/techniques/T1499/002/
- https://attack.mitre.org/techniques/T1499/003/
- https://attack.mitre.org/techniques/T1499/004/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1499/T1499.md
- https://www.cisa.gov/sites/default/files/publications/Understanding-and-Responding-to-Distributed-Denial-of-Service-Attacks.pdf
- https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/netflow/configuration/15-mt/nf-15-mt-book/nf-detct-analy-thrts.pdf
- https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/the-continued-rise-of-ddos-attacks.pdf
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-devicenetworkevents-table
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-deviceprocessevents-table
- https://github.com/SigmaHQ/sigma/tree/master/rules/windows/network_connection
Unlock Pro Content
Get the full detection package for T1499 including response playbook, investigation guide, and atomic red team tests.