Applied Cybernetics Group
T1499.002 — Service Exhaustion Flood
coverage gap
- Technique
T1499.002- Tactics
- Impact
- MISP citations
- 0
- KEV CVEs mapped
- 2
- Community rules
- 0
- thrunt rules
- 0
- Upstream
- https://attack.mitre.org/techniques/T1499/002
MITRE description
Adversaries may target the different network services provided by systems to conduct a denial of service (DoS). Adversaries often target the availability of DNS and web services, however others have been targeted as well.(Citation: Arbor AnnualDoSreport Jan 2018) Web server software can be attacked through a variety of means, some of which apply generally while others are specific to the software being used to provide the service. One example of this type of attack is known as a simple HTTP flood, where an adversary sends a large number of HTTP requests to a web server to overwhelm it and/or an application that runs on top of it. This flood relies on raw volume to accomplish the objective, exhausting any of the various resources required by the victim software to provide the service.(Citation: Cloudflare HTTPflood) Another variation, known as a SSL renegotiation attack, takes advantage of a protocol feature in SSL/TLS. The SSL/TLS protocol suite includes mechanisms for the client and server to agree on an encryption algorithm to use for subsequent secure connections. If SSL renegotiation is enabled, a request can be made for renegotiation of the crypto algorithm. In a renegotiation attack, the adversary establishes a SSL/TLS connection and then proceeds to make a series of renegotiation requests. Because the cryptographic renegotiation has a meaningful cost in computation cycles, this can cause an impact to the availability of the service when done in volume.(Citation: Arbor SSLDoS April 2012)
KEV CVEs mapped to this technique
Per MITRE CTID's hand-curated KEV→ATT&CK mappings — these are the actively-exploited vulnerabilities behind this technique's KEV signal.
Detection coverage
flood detection is rate-based — wrong control class for single-event Sigma; the crash-artifact corner is already covered under T1499.004
The KEV signal behind T1499.002 — D-Link CVE-2021-45382 and CVE-2022-26258 — is Mirai-descendant botnet recruitment: consumer routers compromised to source service-exhaustion floods. For the flood itself, base Sigma is the wrong control class. A service exhaustion flood is defined by volume: any individual HTTP request, DNS query, or TLS handshake within it is well-formed and indistinguishable from a legitimate one, so a single-event rule either never fires or fires on normal traffic. The per-event-detectable corner of Endpoint DoS — the service crash artifact — is already covered by community rules under the sibling T1499.004 (Apache Segmentation Fault, Nginx Core Dump, Windows Audit CVE). The right controls for the flood are WAF/CDN rate limiting, upstream DDoS mitigation, and NDR/netflow volumetric analytics; the right Sigma coverage for the recruitment side is CVE-specific exploit rules on the device-facing surface, which is a separate queue concern. Publishing a T1499.002 rule would be coverage theater.
Compensating controls
- WAF/CDN rate limiting and request-shaping at the edge
- Upstream provider DDoS mitigation/scrubbing
- NDR/netflow volumetric analytics with time-windowed thresholds
- Community T1499.004 crash-artifact rules for the exploitation-DoS corner
- Service health monitoring (worker saturation, connection-pool exhaustion) in APM, not SIEM
Revisit when: thrunt adopting Sigma correlation rules (event_count aggregation over time windows) — a rate-over-threshold correlation on web/DNS logs would then be honestly writable.