Activity timeline
T1499.002 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-07 with 4 reports, and 10 of the 10 threats were reported in the twelve months to 2026-09.
How adversaries use it
T1499.002 Service Exhaustion Flood is catalogued by MITRE ATT&CK under the Impact tactic in the Enterprise matrix, as a sub-technique of T1499 Endpoint Denial of Service. Threadlinqs maps 10 of 2623 tracked threats (0.4%) to it; by severity that is 1 critical, 7 high, 2 medium.
Threats that use T1499.002 most often also use T1499.004 Application or System Exploitation (7 threats), T1190 Exploit Public-Facing Application (6 threats), T1587.004 Exploits (6 threats), T1595.002 Vulnerability Scanning (6 threats), T1499.003 Application Exhaustion Flood (5 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.
Mitigations
MITRE ATT&CK lists 1 mitigation for T1499.002.
Data sources
Telemetry that can reveal T1499.002, per MITRE ATT&CK.
- Application Log — Application Log Content
- Network Traffic — Network Traffic Content, Network Traffic Flow
- Sensor Health — Host Status
Tracked threats
10 tracked threats use T1499.002.
- x47.c Windows Botnet-as-a-Service Weaponizes xAI Grok for AI-Assisted Persistence and AI API Credit Draininghigh
- F5 BIG-IP DNS Denial of Service via BIND DNSSEC Random Subdomain Attack (CVE-2026-11622)high
- NatJack: NAT Connection-Tracking Manipulation Attacks Hijack TCP Sessions Across Windows, Linux, and macOS…high
- Multiple Vulnerabilities in Citrix XenServer 8.4 and 9 Enable Guest-to-Host Escalation and Denial of Service…high
- OpenSSL Silently Patches "HollowByte" Memory-Exhaustion DoS Vulnerabilitymedium
- OpenSSL "HollowByte" TLS Handshake Memory-Amplification DoS (No CVE Assigned)medium
- 148 npm Packages Disguised as Student Tutoring Proxies Turn Browsers Into DDoS Botnet (Lucide Proxy)high
- SolarWinds Serv-U DoS (CVE-2026-28318) — Actively Exploited Uncontrolled Resource Consumption via…high
- NGINX Rift — CVE-2026-42945 Heap Buffer Overflow in ngx_http_rewrite_module (CVSS v4 9.2 Critical…critical
- CVE-2024-3393 PAN-OS DNS Security DoS — Unauthenticated Firewall Crash Forces Maintenance Mode, Perimeter…high
Detection coverage
Threadlinqs maintains 29 detection rules mapped to T1499.002 (SPL 8, KQL 9, Sigma 12). Rule content is available to Blue tier accounts and above; this page shows counts only.
Parent technique
T1499 Endpoint Denial of Service — 127 tracked threats at the technique level.