Application or System Exploitation (T1499.004) is a denial of service technique in the Impact tactic. The adversary exploits a software vulnerability to make an application or system crash and deny availability to users. MITRE lists Windows, Linux, macOS and IaaS.
How attackers use it
Some systems restart critical services automatically after a crash. MITRE points out that this does not save you, because the same flaw can usually be exploited again, producing a persistent denial of service.
The flaw may be known or a zero day. A crash can also ripple outward: applications and systems that depend on the crashed one may fail too. MITRE notes that crashes and restarts can lead to other effects, including Data Destruction, Firmware Corruption and Service Stop, which can extend the outage further.
How to detect it
MITRE's analytics describe exploitation followed quickly by a crash, restart or repeated failure. Look for:
- A service that crashes, restarts or fails repeatedly within a short window.
- Segmentation faults (SIGSEGV) after user or remote input, with the service trying to recover, visible in audit logs and systemd journaling on Linux.
- Application crash or restart loops triggered by malformed input or an exploit file, visible in unified logs and crash monitoring on macOS.
- Repeated container, service or VM termination and restart in cloud workloads, often tied to known crash triggers or fuzzed input.
Treat a crash loop on an internet facing service as a security event, not only a reliability one. Check what request arrived just before each crash.
How to reduce the risk
MITRE lists Filter Network Traffic as the mitigation: use CDN or DoS mitigation services upstream and filter boundary traffic by source, port or protocol.
Beyond the MITRE entry, the most direct way to lower exposure to known flaws is to know which vulnerable components you actually run. The free in-browser dependency scan at gold.safeguard.sh/scan needs no login, the file never leaves your machine, and it covers up to 100 dependencies.
Check your own environment
- Do crash and restart events from internet facing services reach your alerting?
- Is there a list of the exact component versions behind each exposed service?
- Does your WAF or edge filtering see traffic ahead of those services?
- Do dependent systems degrade gracefully when one service is down?
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Why is automatic restart not a complete defense here?
The vulnerability is still there after the restart, so the adversary can trigger the crash again and keep the service down.
