Service Exhaustion Flood (T1499.002) is an Impact technique where an adversary targets the network services a system provides to deny availability. MITRE lists Windows, Linux, macOS and IaaS as platforms. DNS and web services are the usual targets, though others have been hit too.
How attackers use it
MITRE gives two examples.
The simple one is an HTTP flood. The adversary sends a very large number of HTTP requests to a web server, or to the application behind it. It relies on raw volume to use up whatever resource the software needs to keep serving.
The other is an SSL renegotiation attack. SSL/TLS lets a client and server agree again on the encryption algorithm for later connections. If renegotiation is enabled, the adversary opens a connection and then asks to renegotiate over and over. Each renegotiation costs real computation, so doing it in volume hurts availability.
How to detect it
MITRE's analytics describe signals that map well to logs you already collect:
- High frequency, repetitive HTTP or TLS requests from one source IP or a small set of them, with CPU or memory exhaustion on the service.
- Excessive inbound HTTP or TLS connections to Apache or Nginx, causing worker thread exhaustion or crashes.
- The same flood against macOS hosted services such as a local web stack.
- Scripted flooding from one virtual machine or cloud instance against another service, which can also burn money on compute based billing.
Useful data to alert on: requests per second per client, TLS handshake counts per connection, worker or thread pool saturation, and service crash or restart events.
How to reduce the risk
MITRE's mitigation is Filter Network Traffic. Use CDN or specialist DoS providers to filter traffic upstream of your services. Filter boundary traffic by blocking attacking source addresses, targeted ports or the protocols used for transport.
Quick check
Why is TLS renegotiation useful to an attacker?
Each renegotiation request costs the server real computation. Many of them on one connection can degrade the service without needing a large volume of bytes.
