OS Exhaustion Flood (T1499.001) is a denial of service technique in the Impact tactic. It targets the operating system of an endpoint rather than the application on top of it, and MITRE lists Linux, macOS and Windows as affected platforms.
The key idea is that an operating system protects itself with limits. There is a maximum number of concurrent TCP connections, a finite state table, and so on. An attacker does not have to use up real CPU or memory. Hitting those self imposed limits is enough.
How attackers use it
MITRE describes two common forms.
In a SYN flood, a huge number of SYN packets arrive but the three way TCP handshake is never completed. Each half open connection holds a slot. Once the OS hits its connection ceiling, new legitimate requests for any TCP service on the server are refused.
In an ACK flood, the target receives a stream of ACK packets for connections that do not exist. A stateful OS has to search its entire state table to confirm there is no match. Do that for enough packets and the machine turns sluggish or unresponsive, even though no connection was ever established.
How to detect it
MITRE's detection strategy for this technique points at traffic patterns on the host:
- A burst of incomplete TCP handshakes, or ACK packets that match no known connection, aimed at the state table.
- A flood of spoofed SYN or ACK packets, possibly from user space tools or kernel level agents.
- The same pattern on macOS endpoints, where a script issues mass SYN or ACK floods and the machine slows down.
In practice, watch half open connection counts, connection table usage, and packet rates per source. A sudden jump with no matching rise in real sessions is the signal. Pair host metrics with flow data from your edge devices.
How to reduce the risk
MITRE lists one mitigation, Filter Network Traffic:
- Put a content delivery network or a DoS mitigation provider in front of your services so floods are filtered upstream, before they reach your hosts.
- Filter boundary traffic by blocking source addresses sending the attack, blocking the ports being targeted, or blocking the protocols used for transport.
- Enable SYN cookies on hosts exposed to the internet to defend against SYN floods.
Quick check
Why can an ACK flood slow a server that never accepted a connection?
Each stray ACK forces the OS to search its whole state table to confirm there is no matching connection. At volume, that lookup work alone makes the server sluggish.
