Endpoint Denial of Service: Application or System Exploitation (T1499.004)

Tactic: Impact · Platforms: Windows, IaaS, Linux, macOS

The interactive view maps 1 detection strategy, 1 mitigation, 1 software entry to this technique, alongside D3FEND countermeasures and data-component coverage.

Sub-technique of Endpoint Denial of Service (T1499).

Overview

Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users. Some systems may automatically restart critical applications and services when crashes occur, but they can likely be re-exploited to cause a persistent denial of service (DoS) condition.

Adversaries may exploit known or zero-day vulnerabilities to crash applications and/or systems, which may also lead to dependent applications and/or systems to be in a DoS condition. Crashed or restarted applications or systems may also have other effects such as Data Destruction, Firmware Corruption, Service Stop etc. which may further cause a DoS condition and deny availability to critical information, applications and/or systems.

Explore

• Open T1499.004 in the interactive ATT&CK matrix
• ATT&CK Intelligence View guide
• Official MITRE ATT&CK entry for T1499.004
• Sigma detection rules for MITRE ATT&CK
• Built by Shahrukh Khan