T1499 Endpoint Denial Of Service

---
name: "T1499_endpoint-denial-of-service"
description: "Adversaries may perform Endpoint Denial of Service (DoS) attacks to degrade or block the availability of services to users."
category: "business-logic"
version: "18.1"
author: "cyberstrike-official"
tags:
  - mitre-attack
  - enterprise
  - t1499
  - impact
  - windows
  - linux
  - macos
  - containers
  - iaas
technique_id: "T1499"
tactic: "impact"
all_tactics:
  - impact
platforms:
  - Windows
  - Linux
  - macOS
  - Containers
  - IaaS
mitre_url: "https://attack.mitre.org/techniques/T1499"
tech_stack:
  - windows
  - linux
  - macos
  - containers
  - cloud
cwe_ids:
  - CWE-400
chains_with:
  - T1499.001
  - T1499.002
  - T1499.003
  - T1499.004
prerequisites: []
severity_boost:
  T1499.001: "Chain with T1499.001 for deeper attack path"
  T1499.002: "Chain with T1499.002 for deeper attack path"
  T1499.003: "Chain with T1499.003 for deeper attack path"
---

# T1499 Endpoint Denial of Service

## High-Level Description

Adversaries may perform Endpoint Denial of Service (DoS) attacks to degrade or block the availability of services to users. Endpoint DoS can be performed by exhausting the system resources those services are hosted on or exploiting the system to cause a persistent crash condition. Example services include websites, email services, DNS, and web-based applications. Adversaries have been observed conducting DoS attacks for political purposes and to support other malicious activities, including distraction, hacktivism, and extortion.

An Endpoint DoS denies the availability of a service without saturating the network used to provide access to the service. Adversaries can target various layers of the application stack that is hosted on the system used to provide the service. These layers include the Operating Systems (OS), server applications such as web servers, DNS servers, databases, and the (typically web-based) applications that sit on top of them. Attacking each layer requires different techniques that take advantage of bottlenecks that are unique to the respective components. A DoS attack may be generated by a single system or multiple systems spread across the internet, which is commonly referred to as a distributed DoS (DDoS).

To perform DoS attacks against endpoint resources, several aspects apply to multiple methods, including IP address spoofing and botnets.

Adversaries may use the original IP address of an attacking system, or spoof the source IP address to make the attack traffic more difficult to trace back to the attacking system or to enable reflection. This can increase the difficulty defenders have in defending against the attack by reducing or eliminating the effectiveness of filtering by the source address on network defense devices.

Botnets are commonly used to conduct DDoS attacks against networks and services. Large botnets can generate a significant amount of traffic from systems spread across the global internet. Adversaries may have the resources to build out and control their own botnet infrastructure or may rent time on an existing botnet to conduct an attack. In some of the worst cases for DDoS, so many systems are used to generate requests that each one only needs to send out a small amount of traffic to produce enough volume to exhaust the target's resources. In such circumstances, distinguishing DDoS traffic from legitimate clients becomes exceedingly difficult. Botnets have been used in some of the most high-profile DDoS attacks, such as the 2012 series of incidents that targeted major US banks.

In cases where traffic manipulation is used, there may be points in the global network (such as high traffic gateway routers) where packets can be altered and cause legitimate clients to execute code that directs network packets toward a target in high volume. This type of capability was previously used for the purposes of web censorship where client HTTP traffic was modified to include a reference to JavaScript that generated the DDoS code to overwhelm target web servers.

For attacks attempting to saturate the providing network, see Network Denial of Service.

## Kill Chain Phase

- Impact (TA0040)

**Platforms:** Windows, Linux, macOS, Containers, IaaS

## What to Check

- [ ] Identify if Endpoint Denial of Service technique is applicable to target environment
- [ ] Check Windows systems for indicators of Endpoint Denial of Service
- [ ] Check Linux systems for indicators of Endpoint Denial of Service
- [ ] Check macOS systems for indicators of Endpoint Denial of Service
- [ ] Verify mitigations are bypassed or absent (1 known mitigations)
- [ ] Assess detection coverage (1 detection strategies)

## How to Test

### Manual Testing

1. **Identify Attack Surface**: Determine if the target environment is susceptible to Endpoint Denial of Service by examining the target platforms (Windows, Linux, macOS).

2. **Assess Existing Defenses**: Review whether mitigations for T1499 are in place. If defenses are absent or misconfigured, this technique may be exploitable.

3. **Execute Test**: Use tools and methods described in the MITRE ATT&CK page and external references below.

> **Note**: No Atomic Red Team tests available for this technique. See [Atomic Red Team GitHub](https://github.com/redcanaryco/atomic-red-team) for updates.

## Remediation Guide

### M1037 Filter Network Traffic

Leverage services provided by Content Delivery Networks (CDN) or providers specializing in DoS mitigations to filter traffic upstream from services. Filter boundary traffic by blocking source addresses sourcing the attack, blocking ports that are being targeted, or blocking protocols being used for transport. To defend against SYN floods, enable SYN Cookies.

## Detection

### Endpoint Resource Saturation and Crash Pattern Detection Across Platforms

## Risk Assessment

| Finding                                         | Severity | Impact |
| ----------------------------------------------- | -------- | ------ |
| Endpoint Denial of Service technique applicable | High     | Impact |

## CWE Categories

| CWE ID  | Title                             |
| ------- | --------------------------------- |
| CWE-400 | Uncontrolled Resource Consumption |

## References

- [Cisco DoSdetectNetflow](https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/netflow/configuration/15-mt/nf-15-mt-book/nf-detct-analy-thrts.pdf)
- [FSISAC FraudNetDoS September 2012](https://www.ic3.gov/Media/PDF/Y2012/FraudAlertFinancialInstitutionEmployeeCredentialsTargeted.pdf)
- [ArsTechnica Great Firewall of China](https://arstechnica.com/information-technology/2015/03/massive-denial-of-service-attack-on-github-tied-to-chinese-government/)
- [FireEye OpPoisonedHandover February 2016](https://web.archive.org/web/20201127180357/https://www.fireeye.com/blog/threat-research/2014/11/operation-poisoned-handover-unveiling-ties-between-apt-activity-in-hong-kongs-pro-democracy-movement.html)
- [USNYAG IranianBotnet March 2016](https://www.justice.gov/opa/pr/seven-iranians-working-islamic-revolutionary-guard-corps-affiliated-entities-charged)
- [Symantec DDoS October 2014](https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/the-continued-rise-of-ddos-attacks.pdf)
- [Atomic Red Team - T1499](https://github.com/redcanaryco/atomic-red-team/tree/master/atomics/T1499)
- [MITRE ATT&CK - T1499](https://attack.mitre.org/techniques/T1499)