Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Get Started Free →

T1499.003 Application Exhaustion Flood · cyberstrikeus | DecimalAI

cyberstrikeus/T1499.003_application-exhaustion-flood

SkillScore59Maintained

Adversaries may target resource intensive features of applications to cause a denial of service (DoS), denying availability to those applications.

Securityby cyberstrikeus

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec packmitre-attackenterpriset1499.003

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/cyberstrikeus-t1499-003-application-exhaustion-flood/SKILL.md

decimalai skills pull cyberstrikeus-t1499-003-application-exhaustion-flood --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/cyberstrikeus-t1499-003-application-exhaustion-flood/SKILL.md https://app.decimal.ai/s/cyberstrikeus-t1499-003-application-exhaustion-flood/SKILL.md

Raw file: /s/cyberstrikeus-t1499-003-application-exhaustion-flood/SKILL.md ↗ · machine-readable summary at /s/cyberstrikeus-t1499-003-application-exhaustion-flood.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

22 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 23d ago

Yes — +18% lift+25% tokens0% turns59% of whole cases pass with skill (13/22)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-13	✗→✓	▲ Improved	3%	0%
case-14	✗→✓	▲ Improved	-31%	0%
case-15	✗→✓	▲ Improved	-48%	0%
case-19	✗→✓	▲ Improved	-33%	0%
case-04	✓→✓	＝ Same ✓	54%	0%

Showing 5 of 22 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 8/10/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

cyberstrikeus / cyberstrike

.cyberstrike/skill/mitre_attack/TA0040_impact/T1499.003_application-exhaustion-flood/SKILL.md

View on GitHub ↗

License AGPL-3.0Imported 8/10/2026Version v1

Skill contents

SKILL.md

T1499.003 Application Exhaustion Flood

> Sub-technique of: T1499

High-Level Description

Adversaries may target resource intensive features of applications to cause a denial of service (DoS), denying availability to those applications. For example, specific features in web applications may be highly resource intensive. Repeated requests to those features may be able to exhaust system resources and deny access to the application or the server itself.

Kill Chain Phase

Impact (TA0040)

Platforms: Windows, IaaS, Linux, macOS

What to Check

] Identify if Application Exhaustion Flood technique is applicable to target environment
] Check Windows systems for indicators of Application Exhaustion Flood
] Check IaaS systems for indicators of Application Exhaustion Flood
] Check Linux systems for indicators of Application Exhaustion Flood
] Verify mitigations are bypassed or absent (1 known mitigations)
] Assess detection coverage (1 detection strategies)

How to Test

Manual Testing

Identify Attack Surface: Determine if the target environment is susceptible to Application Exhaustion Flood by examining the target platforms (Windows, IaaS, Linux).

Assess Existing Defenses: Review whether mitigations for T1499.003 are in place. If defenses are absent or misconfigured, this technique may be exploitable.

Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.

> Note: No Atomic Red Team tests available for this technique. See Atomic Red Team GitHub for updates.

Remediation Guide

M1037 Filter Network Traffic

Leverage services provided by Content Delivery Networks (CDN) or providers specializing in DoS mitigations to filter traffic upstream from services. Filter boundary traffic by blocking source addresses sourcing the attack, blocking ports that are being targeted, or blocking protocols being used for transport.

Detection

Application Exhaustion Flood Detection Across Platforms

Risk Assessment

| Finding | Severity | Impact | | ------------------------------------------------- | -------- | ------ | | Application Exhaustion Flood technique applicable | Low | Impact |

CWE Categories

| CWE ID | Title | | ------- | --------------------------------- | | CWE-400 | Uncontrolled Resource Consumption |

References

Illustrative Want to see what cyberstrikeus/T1499.003_application-exhaustion-flood would put in front of your model? Preview the rendered body and check its trigger phrases — no LLM call, no signup.

Latest benchmark · publisher runVerified

8/31/2026, 01:33 UTC · 22 cases

Lift

+18%

59% vs 41%

Agent turns

0%

1.0 vs 1.0

Tokens

+25%

3,304.64 vs 2,652.09

fail → pass · 4pass → pass · 9fail → fail · 9

Per-case results (22)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-01 Our security team needs to conduct an assessment of potential application exhaustion flood threats against our web services running across Linux and cloud environments. Please generate an evaluation guide that details key platform checks, manual testing workflows, remediation recommendations for network filtering, and associated weakness mappings.	fail→fail	36,154	48,433	+34%	1	1	0%	4,213	7,965	+89%	0	0	—
case-02 We are reviewing our defense posture against MITRE ATT&CK T1499.003. Could you provide a comprehensive security document summarizing what environment aspects to check across target OS platforms, how to manually test for vulnerabilities in application-layer resource consumption, and the risk/mitigation profile?	fail→fail	30,629	49,435	+61%	1	1	0%	4,765	6,334	+33%	0	0	—
case-03 I need a security assessment template for investigating application-level resource depletion attacks targeting heavy software features. Please outline the necessary platform checklist, manual testing steps, upstream traffic filtering remediation guidance, and risk classification format.	fail→fail	22,484	33,200	+48%	1	1	0%	3,334	5,237	+57%	0	0	—
case-04 Our infrastructure team is analyzing a raw SYN flood attack swamping our edge routers at the network layer under MITRE ATT&CK T1498.001 (Direct Volumetric Flood). Please provide technical defense guidance, relevant network metrics, and risk assessment for this network-layer volumetric DoS attack.	pass→pass	25,142	25,866	+3%	1	1	0%	3,010	4,631	+54%	0	0	—
case-05 We are auditing local OS process creation limits to prevent local users from launching fork bombs that exhaust system process tables under MITRE ATT&CK T1499.001 (OS Exhaustion Flood). Please provide an assessment guide covering local operating system resource controls and ulimit configurations.	pass→pass	33,023	40,527	+23%	1	1	0%	4,006	6,650	+66%	0	0	—
case-06 Our SOC is setting up alert rules for DNS amplification attacks targeting our public resolvers under MITRE ATT&CK T1498.002 (Reflection Volumetric Flood). Please outline the detection strategies and response actions for DNS reflection flooding.	pass→pass	24,454	21,470	-12%	1	1	0%	3,746	3,926	+5%	0	0	—
case-07 We are documenting software security weaknesses for our application developers who build CPU-heavy report generation endpoints. Most devs assume this is a standard input validation flaw (CWE-20) or memory leak (CWE-401). What specific Common Weakness Enumeration ID corresponds to application resource consumption exhaustion like T1499.003, and what severity should be assigned when evaluating this vulnerability profile?	fail→fail	23,595	18,650	-21%	1	1	0%	3,066	2,841	-7%	0	0	—
case-08 An auditor claims that application exhaustion flood attacks (ATT&CK T1499.003) only affect Linux web servers hosting web applications, and that desktop environments like macOS or cloud IaaS control planes are exempt. Which platforms are officially targeted by sub-technique T1499.003?	pass→pass	13,964	8,954	-36%	1	1	0%	1,426	1,276	-11%	0	0	—
case-09 We are categorizing MITRE ATT&CK technique T1499.003 in our SIEM matrix. Some analysts marked it under the Persistence tactics phase because heavy requests keep running. Under which MITRE ATT&CK tactic phase and parent technique does Application Exhaustion Flood officially belong?	pass→pass	10,884	4,033	-63%	1	1	0%	906	1,365	+51%	0	0	—
case-10 Our QA team wants to test heavy API endpoints for resource depletion. They want to jump straight to running load generation tools without any prep work. What are the structured initial manual testing steps required before executing tests for application exhaustion floods?	fail→fail	22,292	24,923	+12%	1	1	0%	2,558	3,668	+43%	0	0	—
case-11 Our red team wants to execute pre-built automated scripts from Atomic Red Team to test sub-technique T1499.003 against our staging environment. How should we configure the Atomic Red Team test execution harness for this specific sub-technique?	fail→fail	18,900	16,058	-15%	1	1	0%	2,500	3,462	+38%	0	0	—
case-12 When implementing network filtering remediation M1037 for application exhaustion flood attacks, management wants to know the precise traffic blocking techniques that upstream CDN or DoS mitigation services should deploy at the network boundary. What specific elements should be filtered?	fail→fail	23,060	19,420	-16%	1	1	0%	2,726	3,646	+34%	0	0	—
case-13 We are building an audit checklist for application exhaustion flood defenses. The audit team wants to know how many known MITRE mitigations exist for T1499.003 and what key items should be checked when evaluating system defenses.	fail→pass	18,001	18,932	+5%	1	1	0%	2,936	3,023	+3%	0	0	—
case-14 During a vulnerability scan, an automated scanner flagged potential susceptibility to application exhaustion flood (T1499.003) and assigned it Critical severity because it causes denial of service. What severity rating and impact category does the risk assessment framework assign to an applicable Application Exhaustion Flood finding?	fail→pass	15,378	7,851	-49%	1	1	0%	1,778	1,233	-31%	0	0	—
case-15 Our SOC lead wants to know how many distinct detection strategies are specified for monitoring application exhaustion flood (T1499.003) threats across platforms, and how to structure the detection assessment checklist item.	fail→pass	16,220	9,962	-39%	1	1	0%	2,622	1,368	-48%	0	0	—
case-16 A pentester needs the complete 3-step manual testing procedure for T1499.003 application exhaustion flood evaluation. They plan to use custom scripts. What exact 3 steps constitute the manual testing framework?	fail→fail	27,432	25,836	-6%	1	1	0%	2,164	2,596	+20%	0	0	—
case-17 Our architecture board is arguing whether application exhaustion flood (T1499.003) remediation M1037 should be applied at the local application server level or upstream using CDN / DoS service providers. What specific deployment strategy does M1037 prescribe?	pass→pass	19,656	16,021	-18%	1	1	0%	2,321	2,462	+6%	0	0	—
case-18 We are conducting a platform-by-platform baseline audit for application exhaustion flood vulnerabilities. What operating systems and environment types must be checked according to the T1499.003 platform coverage?	pass→pass	13,703	8,685	-37%	1	1	0%	1,146	1,300	+13%	0	0	—
case-19 Our network engineering team wants external technical references for detecting and analyzing application exhaustion DoS threats via NetFlow and infrastructure reports. Which external technical references are provided for T1499.003 research?	fail→pass	19,791	5,165	-74%	1	1	0%	2,656	1,778	-33%	0	0	—
case-20 An internal security report needs the official ATT&CK sub-technique ID for Application Exhaustion Flood and its corresponding software weakness enumeration mapping. What are the exact ID numbers for both?	pass→pass	12,206	7,865	-36%	1	1	0%	1,346	1,062	-21%	0	0	—
case-21 Please explain the fundamental mechanism behind an application exhaustion flood attack targeting web applications. How do adversaries achieve denial of service under T1499.003?	pass→pass	21,613	17,951	-17%	1	1	0%	2,467	3,147	+28%	0	0	—
case-22 We are assembling an executive summary checklist for assessing T1499.003 readiness in our enterprise. What primary checklist items need to be evaluated during the assessment?	fail→fail	21,811	22,922	+5%	1	1	0%	2,654	3,732	+41%	0	0	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 22 cases were attempted. The headline lift of +18 percentage points is the difference between those two pass rates over the 22 comparable cases.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 40.9%
Pass rate with the skill: 59.1%
Cases attempted: 22
Cases counted toward lift: 22
Cases that regressed: 0
Skill version measured: v1
Run completed: 8/31/2026, 01:33 UTC

Measured example — same prompt, with vs. without the skill · from the benchmark run · case case-13

Prompt

We are building an audit checklist for application exhaustion flood defenses. The audit team wants to know how many known MITRE mitigations exist for T1499.003 and what key items should be checked when evaluating system defenses.

Without the skill loaded, the model failed this case. With it loaded, the same prompt on the same model passed. This is one improved case from the latest verified run; every case, including any that regressed, is in the table above.

Show both answers

SkillScore blends 4 signals1 of 4 complete

BenchmarkPass rate WITH skill on a verified run59

Live evalNeeds ≥10 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Efficiency · separate axis (at equal correctness)+0% turns+27% tokens

Shown for transparency; not credited unless a verified run shows no correctness regression.

Backed by 1 of 4 signals — each added signal makes the score more robust.

Verified on gemini-3.6-flash · re-tested 22 days ago

Other measured skills in the registry, with their headline benchmark lift.