// MITRE ATT&CK
T1499.001 · OS Exhaustion Flood
Sub-technique of T1499 · Endpoint Denial of Service.
Adversaries may launch a denial of service (DoS) attack targeting an endpoint's operating system (OS). A system's OS is responsible for managing the finite resources as well as preventing the entire system from being overwhelmed by excessive demands on its capacity. These attacks do not need to exha...
How to detect & mitigate it
Detecting OS Exhaustion Flood starts with your SIEM/EDR telemetry. Write a detection rule with the Sigma generator, analyze suspicious logs in the log analyzer, and place the technique on your coverage with the ATT&CK matrix.
Related techniques
T1561.002
Disk Structure Wipe T1498.001
Direct Network Flood T1491.002
External Defacement T1485.001
Lifecycle-Triggered Deletion T1496.003
SMS Pumping T1499.003
Application Exhaustion Flood T1561
Disk Wipe T1565.001
Stored Data Manipulation
Disk Structure Wipe T1498.001
Direct Network Flood T1491.002
External Defacement T1485.001
Lifecycle-Triggered Deletion T1496.003
SMS Pumping T1499.003
Application Exhaustion Flood T1561
Disk Wipe T1565.001
Stored Data Manipulation
Source: MITRE ATT&CK®. ATT&CK is a registered trademark of The MITRE Corporation. Content for educational purposes.