Application Exhaustion Flood (T1499.003) is a denial of service technique where an adversary goes after the resource hungry features of an application. MITRE places it in the Impact tactic and lists Windows, Linux, macOS and IaaS.
How attackers use it
MITRE keeps the description short. Specific features in a web application can be very expensive to run, such as a heavy search, a report builder or a complex query. Repeated requests to those features can exhaust system resources and deny access to the application, or even to the server hosting it.
The point for defenders is that the traffic can look legitimate. It may not be a flood of packets at all, only a modest number of requests to the one endpoint that costs the most.
How to detect it
MITRE's analytics suggest looking for:
- Repeated calls to high resource endpoints or interface components, showing up as raised request volumes, long lock times or frequent crash recoveries.
- Automated scripts or repeated API requests that push backends such as Apache with PHP, databases or mail servers into high CPU or memory use, with syslog errors and many spawned processes.
- On macOS, repeated triggering of application workflows that leave spin reports or crash dumps in the unified logs.
- In cloud hosted apps, compute exhaustion, high rates of 5xx errors and frequent autoscaling events.
A per endpoint cost view helps. Know which routes are expensive, and alert when their request rate departs from normal.
How to reduce the risk
MITRE lists Filter Network Traffic. Use a CDN or DoS mitigation provider to filter upstream, and filter at your boundary by source address, targeted port or protocol.
Quick check
Why might this attack not look like a flood?
The attacker targets one costly feature, so a small number of requests can do the damage. Total traffic volume may stay close to normal.
