aol.pm

Endpoint Denial of Service

Technique · ATTACK:enterprise:T1499

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:enterprise:T1499",
  "title": "Endpoint Denial of Service",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1499",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--c675646d-e204-4aa8-978d-e3d6d65885c4",
  "external_id": "T1499",
  "domain": "enterprise",
  "created": "2019-04-18T11:00:55.862Z",
  "modified": "2025-10-24T17:49:22.088Z",
  "version": "1.2",
  "aliases": [

  ],
  "tactics": [
    "impact"
  ],
  "source_references": [
    {
      "source_name": "Cisco DoSdetectNetflow",
      "url": "https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/netflow/configuration/15-mt/nf-15-mt-book/nf-detct-analy-thrts.pdf"
    },
    {
      "source_name": "FSISAC FraudNetDoS September 2012",
      "url": "https://www.ic3.gov/Media/PDF/Y2012/FraudAlertFinancialInstitutionEmployeeCredentialsTargeted.pdf"
    },
    {
      "source_name": "ArsTechnica Great Firewall of China",
      "url": "https://arstechnica.com/information-technology/2015/03/massive-denial-of-service-attack-on-github-tied-to-chinese-government/"
    },
    {
      "source_name": "FireEye OpPoisonedHandover February 2016",
      "url": "https://web.archive.org/web/20201127180357/https://www.fireeye.com/blog/threat-research/2014/11/operation-poisoned-handover-unveiling-ties-between-apt-activity-in-hong-kongs-pro-democracy-movement.html"
    },
    {
      "source_name": "USNYAG IranianBotnet March 2016",
      "url": "https://www.justice.gov/opa/pr/seven-iranians-working-islamic-revolutionary-guard-corps-affiliated-entities-charged"
    },
    {
      "source_name": "Symantec DDoS October 2014",
      "url": "https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/the-continued-rise-of-ddos-attacks.pdf"
    }
  ]
}

Explicit source assertions (8)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:T1499.003 → subtechnique-of → ATTACK:enterprise:T1499

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--32d96aee-4192-4c65-81ef-ced7256c3013

ATTACK:enterprise:M1037 → mitigates → ATTACK:enterprise:T1499

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5d37f644-31c5-414e-9a83-cb6fb36b87e0

CERT-EU DDoS March 2017

ATTACK:enterprise:S0052 → uses → ATTACK:enterprise:T1499

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5e5b108b-fec6-4d44-ad9a-9302d4f6e368

ESET Dukes October 2019

ATTACK:enterprise:T1499.002 → subtechnique-of → ATTACK:enterprise:T1499

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--87146c3d-f6f3-4800-b74c-50e1b1cbfa9f

ATTACK:enterprise:T1499.004 → subtechnique-of → ATTACK:enterprise:T1499

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9131af72-6fa7-4292-b959-05f774e77f7e

ATTACK:enterprise:G0034 → uses → ATTACK:enterprise:T1499

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--927272db-cc41-45ce-bb38-e3e37ac3a68e

US District Court Indictment GRU Unit 74455 October 2020

ATTACK:enterprise:T1499.001 → subtechnique-of → ATTACK:enterprise:T1499

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a276f020-9642-4608-8520-fca70866c0d9

ATTACK:enterprise:S0412 → uses → ATTACK:enterprise:T1499

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--dda297c6-2edc-47c5-b32b-0d4ef0f85be4

Talos ZxShell Oct 2014 · FireEye APT41 Aug 2019

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.