DET0356 Endpoint DoS via OS Exhaustion Flood Detection Strategy
| Item |
Value |
| ID |
DET0356 |
| Version |
1.0 |
| Created |
21 October 2025 |
| Last Modified |
21 October 2025 |
Technique Detected: T1499.001 (OS Exhaustion Flood)
Analytics
Windows
AN1012
Burst of incomplete TCP handshakes (e.g., SYN floods) or uncorrelated ACK packets targeting the state table resulting in OS resource exhaustion.
Log Sources
Mutable Elements
| Field |
Description |
| TimeWindow |
Threshold for burst traffic over short period (e.g., 30s - 2min) |
| ConnectionRateThreshold |
SYN/ACK packet rate threshold that triggers investigation |
| ProcessParentCheck |
Whether parent process of flooding tool is a known admin shell or unexpected context |
Linux
AN1013
Flood of spoofed SYN or ACK packets causing exhaustion of OS TCP state table, potentially via user-space utilities or kernel-level DoS agents.
Log Sources
Mutable Elements
| Field |
Description |
| AmplificationThreshold |
Volume of fake TCP requests before OS begins degradation |
| Interface |
Which network interface is being targeted or impacted |
macOS
AN1014
Adversary tool/script issuing mass SYN/ACK floods that degrade OS responsiveness and interrupt service response on macOS endpoints.
Log Sources
Mutable Elements
| Field |
Description |
| SystemLoadThreshold |
Observed CPU/network degradation level that triggers response |
| ToolExecutionPath |
Where DoS tools are commonly dropped or compiled |