Sub-technique of T1499 Endpoint Denial of Service.View on attack.mitre.org
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users. Some systems may automatically restart critical applications and services when crashes occur, but they can likely be re-exploited to cause a persistent denial of service (DoS) condition.
Adversaries may exploit known or zero-day vulnerabilities to crash applications and/or systems, which may also lead to dependent applications and/or systems to be in a DoS condition. Crashed or restarted applications or systems may also have other effects such as Data Destruction, Firmware Corruption, Service Stop etc. which may further cause a DoS condition and deny availability to critical information, applications and/or systems.
Rules on DetectionCode tagged with T1499.004.
| Rule | Level | Log source |
|---|---|---|
| Audit CVE Event | critical | windows / NULL |
| Apache Segmentation Fault | high | NULL / NULL |
| Nginx Core Dump | high | NULL / NULL |
None recorded.
None recorded.
| Used by | Procedure example |
|---|---|
| MalwareIndustroyer | Industroyer uses a custom DoS tool that leverages CVE-2015-5374 and targets hardcoded IP addresses of Siemens SIPROTEC devices. |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
