T1499.003 Application Exhaustion Flood
sub-techniqueEnterpriseAdversaries may target resource intensive features of applications to cause a denial of service (DoS), denying availability to those applications. For example, specific features in web applications may be highly resource intensive. Repeated requests to those features may be able to exhaust system resources and deny access to the application or the server itself.
platforms
Platforms this applies to.
tactics
ATT&CK tactics this technique serves.
sub-technique of
The broader entity this sits under.
mitigations
ATT&CK mitigations that reduce this.
detected by (5)
Data components that detect this.
NIST CSF 2.0 — areas of relevance (Protect / Detect)
NIST CSF 2.0 areas this most relates to (evidence-ranked).
- DE.CMContinuous Monitoringstrong · backed by 5 of 9 mapped controls
- PR.DSData Securitystrong · backed by 5 of 9 mapped controls
- PR.IRTechnology Infrastructure Resiliencemoderate · backed by 3 of 9 mapped controls
Derived from MITRE CTID (Apache-2.0) and the NIST 800-53 ↔ CSF crosswalk (public domain). Indicative relevance along the Protect/Detect axis — not a compliance assessment or coverage claim.
mitigating controls (9)
Security controls that mitigate this.
attack patterns (1)
CAPEC attack patterns that exploit this.
source
Where this definition is published.