Endpoint Denial of Service via Process/Service Resource Exhaustion Flood

// THREAT: Endpoint DoS via resource exhaustion (T1499.002/.003) - lightweight, event-driven signals only
let LookbackWindow = 1h;
let ForkBombThreshold = 50; // child processes from one parent within the window
// Signal 1: process-creation flood from a single parent (fork bomb / malicious spawn loop)
let ProcessFlood = DeviceProcessEvents
| where Timestamp > ago(LookbackWindow)
| summarize ChildCount=count(), Children=make_set(FileName, 20) by DeviceName, InitiatingProcessId, InitiatingProcessFileName, bin(Timestamp, 5m)
| where ChildCount >= ForkBombThreshold
| extend Indicator = "ProcessCreationFloodFromSingleParent"
| extend RiskScore = 90
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessId, ChildCount, Children, Indicator, RiskScore;
// Signal 2: Windows native resource-exhaustion detector events (event-driven, not polled)
let ResourceExhaustion = Event
| where Timestamp > ago(LookbackWindow)
| where Source == "Microsoft-Windows-Resource-Exhaustion-Detector"
| where EventID in (2004, 2005)
| extend Indicator = "WindowsResourceExhaustionDetectorFired"
| extend RiskScore = 80
| project Timestamp, Computer, EventID, RenderedDescription, Indicator, RiskScore;
// Signal 3: application hang clustering (multiple distinct processes hanging on one host in a short window)
let AppHangCluster = Event
| where Timestamp > ago(LookbackWindow)
| where Source == "Application Hang" and EventID == 1002
| summarize HangCount=count(), HungProcesses=make_set(RenderedDescription, 10) by Computer, bin(Timestamp, 15m)
| where HangCount >= 3
| extend Indicator = "MultiProcessApplicationHangCluster"
| extend RiskScore = 70
| project Timestamp, Computer, HangCount, HungProcesses, Indicator, RiskScore;
union ProcessFlood, ResourceExhaustion, AppHangCluster
| sort by RiskScore desc, Timestamp desc

(
  index=mde sourcetype="DeviceProcessEvents"
  | bucket _time span=5m
  | stats count AS ChildCount, values(FileName) AS Children by DeviceName, InitiatingProcessId, InitiatingProcessFileName, _time
  | where ChildCount >= 50
  | eval Indicator="ProcessCreationFloodFromSingleParent", RiskScore=90
  | table _time, DeviceName, InitiatingProcessFileName, InitiatingProcessId, ChildCount, Children, Indicator, RiskScore
)
| append [
    search index=wineventlog source="Microsoft-Windows-Resource-Exhaustion-Detector/Operational" (EventCode=2004 OR EventCode=2005)
    | eval Indicator="WindowsResourceExhaustionDetectorFired", RiskScore=80
    | table _time, Computer, EventCode, Message, Indicator, RiskScore
  ]
| append [
    search index=wineventlog sourcetype="WinEventLog:Application" source="Application Hang" EventCode=1002
    | bucket _time span=15m
    | stats count AS HangCount, values(Message) AS HungProcesses by Computer, _time
    | where HangCount >= 3
    | eval Indicator="MultiProcessApplicationHangCluster", RiskScore=70
    | table _time, Computer, HangCount, HungProcesses, Indicator, RiskScore
  ]
| sort - RiskScore

sequence by process.parent.entity_id with maxspan=5m
  [process where event.type == "start"] with runs=50

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS EventTime,
  devicename AS ComputerName,
  sourceprocessname AS ParentProcess,
  COUNT(*) AS ChildCount
FROM events
WHERE
  LOGSOURCETYPEID = 12
  AND QIDNAME(qid) = 'Process Create'
  AND starttime > NOW() - 3600000
GROUP BY devicename, sourceprocessname, starttime
HAVING COUNT(*) >= 50
ORDER BY ChildCount DESC

_sourceCategory=*/Windows/Sysmon*
| where (%"EventID" = "1" or EventID = 1)
| parse field=_raw "ParentImage: *\r" as ParentImage nodrop
| parse field=_raw "ParentProcessId: *\r" as ParentProcessId nodrop
| timeslice 5m
| stats count as ChildCount by ParentImage, ParentProcessId, _timeslice
| where ChildCount >= 50
| eval Indicator = "ProcessCreationFloodFromSingleParent"
| sort - ChildCount

rule endpoint_dos_process_flood {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects a single parent process spawning an excessive number of children within a short window, consistent with a fork-bomb / endpoint DoS spawn loop"
    severity = "HIGH"
    priority = "HIGH"
    mitre_attack_tactic = "Impact"
    mitre_attack_technique = "T1499.002"
    created = "2026-07-18"

  events:
    $proc.metadata.event_type = "PROCESS_LAUNCH"
    $proc.principal.process.parent_pid = $parent_pid
    $proc.principal.hostname = $hostname

  match:
    $parent_pid, $hostname over 5m

  condition:
    #proc >= 50
}

#event_simpleName=ProcessRollup2
| groupBy([ParentProcessId, ComputerName, bucket(field="@timestamp", span=5m)], function=[count(as=ChildCount)])
| ChildCount >= 50
| sort(ChildCount, order=desc)