Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Get Started Free →

T1499.004 Application or System Exploitation · cyberstrikeus | DecimalAI

cyberstrikeus/T1499.004_application-or-system-exploitation

SkillScore96Maintained

Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.

Securityby cyberstrikeus

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec packmitre-attackenterpriset1499.004

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/cyberstrikeus-t1499-004-application-or-system-exploitation/SKILL.md

decimalai skills pull cyberstrikeus-t1499-004-application-or-system-exploitation --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/cyberstrikeus-t1499-004-application-or-system-exploitation/SKILL.md https://app.decimal.ai/s/cyberstrikeus-t1499-004-application-or-system-exploitation/SKILL.md

Raw file: /s/cyberstrikeus-t1499-004-application-or-system-exploitation/SKILL.md ↗ · machine-readable summary at /s/cyberstrikeus-t1499-004-application-or-system-exploitation.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

25 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 23d ago

Yes — +40% lift-13% tokens0% turns96% of whole cases pass with skill (24/25)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-01	✗→✓	▲ Improved	24%	0%
case-04	✗→✓	▲ Improved	-49%	0%
case-05	✗→✓	▲ Improved	-64%	0%
case-08	✗→✓	▲ Improved	15%	0%
case-10	✗→✓	▲ Improved	-27%	0%

Showing 5 of 25 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 8/10/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

cyberstrikeus / cyberstrike

.cyberstrike/skill/mitre_attack/TA0040_impact/T1499.004_application-or-system-exploitation/SKILL.md

View on GitHub ↗

License AGPL-3.0Imported 9/2/2026Version v1

Skill contents

SKILL.md

T1499.004 Application or System Exploitation

> Sub-technique of: T1499

High-Level Description

Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users. Some systems may automatically restart critical applications and services when crashes occur, but they can likely be re-exploited to cause a persistent denial of service (DoS) condition.

Adversaries may exploit known or zero-day vulnerabilities to crash applications and/or systems, which may also lead to dependent applications and/or systems to be in a DoS condition. Crashed or restarted applications or systems may also have other effects such as Data Destruction, Firmware Corruption, Service Stop etc. which may further cause a DoS condition and deny availability to critical information, applications and/or systems.

Kill Chain Phase

Impact (TA0040)

Platforms: Windows, IaaS, Linux, macOS

What to Check

] Identify if Application or System Exploitation technique is applicable to target environment
] Check Windows systems for indicators of Application or System Exploitation
] Check IaaS systems for indicators of Application or System Exploitation
] Check Linux systems for indicators of Application or System Exploitation
] Verify mitigations are bypassed or absent (1 known mitigations)
] Assess detection coverage (1 detection strategies)

How to Test

Manual Testing

Identify Attack Surface: Determine if the target environment is susceptible to Application or System Exploitation by examining the target platforms (Windows, IaaS, Linux).

Assess Existing Defenses: Review whether mitigations for T1499.004 are in place. If defenses are absent or misconfigured, this technique may be exploitable.

Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.

> Note: No Atomic Red Team tests available for this technique. See Atomic Red Team GitHub for updates.

Remediation Guide

M1037 Filter Network Traffic

Leverage services provided by Content Delivery Networks (CDN) or providers specializing in DoS mitigations to filter traffic upstream from services. Filter boundary traffic by blocking source addresses sourcing the attack, blocking ports that are being targeted, or blocking protocols being used for transport.

Detection

Detection Strategy for Endpoint DoS via Application or System Exploitation

Risk Assessment

| Finding | Severity | Impact | | ------------------------------------------------------- | -------- | ------ | | Application or System Exploitation technique applicable | High | Impact |

CWE Categories

| CWE ID | Title | | ------- | --------------------------------- | | CWE-400 | Uncontrolled Resource Consumption |

References

Illustrative Want to see what cyberstrikeus/T1499.004_application-or-system-exploitation would put in front of your model? Preview the rendered body and check its trigger phrases — no LLM call, no signup.

Latest benchmark · publisher runVerified

8/31/2026, 01:18 UTC · 25 cases

Lift

+40%

96% vs 56%

Agent turns

0%

1.0 vs 1.0

Tokens

-13%

1,968.88 vs 2,253.56

fail → pass · 10pass → pass · 14fail → fail · 1

Per-case results (25)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-25 How do we deploy System Guard and Exploit Protection policies via Windows Group Policy to force Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR) on all 64-bit binaries?	pass→pass	20,851	15,989	-23%	1	1	0%	2,763	3,578	+29%	0	0	—
case-01 I need a technical playbook for assessing our risk against application and system crash exploitation sub-techniques. Please explain the steps required to identify attack surfaces across our platforms, how to check for existing defenses when automated atomic tests are unavailable, and what network filtering controls should be deployed. Formulate your guidance as an actionable playbook containing an Assessment Phase, Remediation Plan, and References.	fail→pass	40,014	46,833	+17%	1	1	0%	5,462	6,766	+24%	0	0	—
case-02 When documenting endpoint availability risks from vulnerability-triggered software crashes in MITRE ATT&CK, which exact sub-technique ID under T1499 represents endpoint crash exploitation?	pass→pass	11,495	10,028	-13%	1	1	0%	1,232	1,213	-2%	0	0	—
case-03 Vulnerability exploitation is commonly mapped to Execution (TA0002) or Initial Access (TA0001). Under which MITRE ATT&CK tactic/kill chain phase (TA code) is the endpoint software crash DoS sub-technique classified?	pass→pass	10,845	8,687	-20%	1	1	0%	1,073	1,278	+19%	0	0	—
case-04 Endpoint DoS exploits are often assumed to affect only server OS environments like Linux and Windows Server. Which four computing operating environments and platform types are listed in scope for vulnerability-triggered system crash attacks under ATT&CK sub-technique T1499.004?	fail→pass	17,765	8,724	-51%	1	1	0%	2,169	1,115	-49%	0	0	—
case-05 Software crash exploits are frequently categorized under CWE-119 (Buffer Errors) or CWE-476 (Null Pointer Dereference). Which specific Common Weakness Enumeration ID is formally mapped to the endpoint application crash DoS sub-technique?	fail→pass	27,732	8,496	-69%	1	1	0%	3,601	1,279	-64%	0	0	—
case-06 Endpoint exploit mitigations usually rely on M1038 (Vulnerability Protection) or M1050 (Exploit Protection). Which specific MITRE ATT&CK mitigation identifier (M-code) is assigned to counter software crash exploitation through traffic control?	pass→pass	32,080	3,002	-91%	1	1	0%	5,163	1,228	-76%	0	0	—
case-07 Boundary filtering for application DoS usually focuses strictly on source IP addresses. What specific network boundary attributes should be filtered under mitigation M1037 to counter crash exploit traffic?	fail→fail	13,752	22,020	+60%	1	1	0%	2,073	3,309	+60%	0	0	—
case-08 Network filtering against exploit traffic is commonly deployed at host software firewalls rather than upstream. What upstream architectural control is recommended under M1037 to absorb and inspect exploit traffic before it hits local applications?	fail→pass	10,172	6,465	-36%	1	1	0%	1,537	1,768	+15%	0	0	—
case-09 Engineers often assume standard Red Canary Atomic Red Team test scripts exist for every ATT&CK sub-technique. When preparing automated red team simulations for T1499.004, what is the current availability status of Atomic Red Team tests?	pass→pass	17,212	9,073	-47%	1	1	0%	1,954	1,356	-31%	0	0	—
case-10 Attack surface checks for crash exploits often focus exclusively on desktop systems. During step 1 of manual testing for application crash susceptibility, which three target platforms must be examined?	fail→pass	16,473	8,610	-48%	1	1	0%	1,556	1,129	-27%	0	0	—
case-11 Defense models typically list 3 to 5 distinct ATT&CK mitigations for DoS techniques. How many known MITRE ATT&CK mitigations are listed for evaluating defense bypasses in sub-technique T1499.004?	fail→pass	26,615	3,398	-87%	1	1	0%	3,934	1,141	-71%	0	0	—
case-12 Security teams usually expect multiple distinct detection strategies for endpoint crash events. How many formal detection strategies are specified in the framework for endpoint crash DoS via application exploitation?	fail→pass	16,813	8,362	-50%	1	1	0%	2,641	1,144	-57%	0	0	—
case-13 Denial of service vulnerabilities that do not provide remote code execution are often classified as Medium severity. What risk severity rating is assigned to findings where application crash exploitation is applicable to the target environment?	pass→pass	16,859	8,223	-51%	1	1	0%	1,771	1,193	-33%	0	0	—
case-14 Crash exploitation findings are often mapped to Confidentiality or Integrity impact categories in risk matrices. Under the risk assessment matrix for T1499.004, what impact category corresponds to applicable crash exploit findings?	fail→pass	8,194	4,023	-51%	1	1	0%	1,224	1,374	+12%	0	0	—
case-15 Application DoS references frequently cite Apache HTTP Server or OpenSSL vulnerabilities. Which 2015 DNS software exploit in the wild is cited as a primary reference for application crash DoS?	fail→pass	10,629	2,933	-72%	1	1	0%	864	1,230	+42%	0	0	—
case-16 ATT&CK reference links often default to the top-level technique URL. What exact URL path structure on attack.mitre.org is referenced for sub-technique T1499.004 documentation?	pass→pass	4,836	8,151	+69%	1	1	0%	905	1,304	+44%	0	0	—
case-17 Atomic Red Team repository paths often use top-level folder structures like /atomics/T1499/. What exact GitHub repository path is referenced for checking Atomic Red Team test availability for T1499.004?	pass→pass	12,123	8,444	-30%	1	1	0%	1,338	1,402	+5%	0	0	—
case-18 Application crashes are often treated as isolated process events that do not affect other services once restarted. Why can exploiting a software crash vulnerability cause broader DoS even if target applications automatically restart upon crashing?	pass→pass	17,420	20,522	+18%	1	1	0%	2,498	3,065	+23%	0	0	—
case-19 Indicator checks for crash exploits are often conducted only on Windows domain controllers. Which OS and cloud platform environments require explicit checks for indicators of application crash exploitation?	pass→pass	23,414	3,712	-84%	1	1	0%	2,843	1,350	-53%	0	0	—
case-20 CWE-400 is often misnamed as Resource Exhaustion via Memory Leak. What is the exact official title of CWE-400 as mapped in AppSec weakness standards?	pass→pass	7,628	8,289	+9%	1	1	0%	385	1,083	+181%	0	0	—
case-21 Evaluating defense coverage requires executing live exploit payloads in test environments. In step 2 of manual testing for application crash exploitation risk, what action should be taken regarding mitigations?	fail→pass	12,095	8,890	-26%	1	1	0%	988	1,388	+40%	0	0	—
case-22 Traffic filtering in ATT&CK is often titled Ingress Traffic Filtering. What is the official MITRE ATT&CK title associated with mitigation ID M1037?	pass→pass	8,081	8,141	+1%	1	1	0%	424	1,294	+205%	0	0	—
case-23 Our AppSec team needs to configure ModSecurity WAF rules to detect and block SQL injection payload attempts targeting our public web forms. Provide the SQLi regex patterns, anomaly scoring thresholds, and WAF directive syntax.	pass→pass	31,075	19,308	-38%	1	1	0%	4,969	4,311	-13%	0	0	—
case-24 We need to harden our Linux kernel network stack against high-volume SYN flood TCP attacks by tuning sysctl parameters. Explain how to configure tcp_syncookies, tcp_max_syn_backlog, and tcp_synack_retries in /etc/sysctl.conf.	pass→pass	21,674	22,228	+3%	1	1	0%	2,972	3,924	+32%	0	0	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 25 cases were attempted. The headline lift of +40 percentage points is the difference between those two pass rates over the 25 comparable cases.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 56%
Pass rate with the skill: 96%
Cases attempted: 25
Cases counted toward lift: 25
Cases that regressed: 0
Skill version measured: v1
Run completed: 8/31/2026, 01:18 UTC

Measured example — same prompt, with vs. without the skill · from the benchmark run · case case-01

Prompt

I need a technical playbook for assessing our risk against application and system crash exploitation sub-techniques. Please explain the steps required to identify attack surfaces across our platforms, how to check for existing defenses when automated atomic tests are unavailable, and what network filtering controls should be deployed. Formulate your guidance as an actionable playbook containing an Assessment Phase, Remediation Plan, and References.

Without the skill loaded, the model failed this case. With it loaded, the same prompt on the same model passed. This is one improved case from the latest verified run; every case, including any that regressed, is in the table above.

Show both answers

SkillScore blends 4 signals1 of 4 complete

BenchmarkPass rate WITH skill on a verified run96

Live evalNeeds ≥10 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Efficiency · separate axis (at equal correctness)+0% turns-9% tokens

Shown for transparency; not credited unless a verified run shows no correctness regression.

Backed by 1 of 4 signals — each added signal makes the score more robust.

Verified on gemini-3.6-flash · re-tested 22 days ago

Other measured skills in the registry, with their headline benchmark lift.