Live Active security incident? Get immediate response
MITRE ATT&CK® Analytic

AN0584: Analytic 0584

Excessive resource exhaustion or service crash induced by processes launched by users or scripts that rapidly consume CPU/memory or attempt malformed service interactions.

EnterpriseAN0584AnalyticObject v1.0 Modified
Glexia's Take

Analyst context for executives and security teams

Analyst confidence Medium

This analytic points to a Windows resilience risk: user- or script-launched processes that rapidly exhaust CPU or memory, or interact with services in malformed ways, can cause service crashes or resource starvation. For leaders, the value is not attribution; it is validating whether critical Windows services and hosts are observable, protected, and recoverable when local processes create denial-of-service-like conditions.

Executive priority

Prioritize this where Windows systems support business-critical applications, operations, or shared services. The key management question is whether the organization can distinguish normal workload spikes from process-driven resource exhaustion quickly enough to preserve service continuity, support incident triage, and provide audit evidence around monitoring and response. Because ATT&CK provides no tactic, relationship, or detection logic for this object, local criticality and telemetry maturity should drive priority.

Technical view

SOC and IR teams should validate visibility into Windows process launches, parent-child process context, script execution, CPU and memory consumption trends, service crash events, and malformed or repeated service interaction signals where available. Detection engineering should focus on correlation rather than a single threshold: suspicious or unusual user/script-launched processes plus rapid resource consumption or service instability. Baselines are important because legitimate administrative scripts, software updates, backup jobs, and performance testing can also create high resource usage.

Likely telemetry

  • Windows process creation events with command line and parent process context
  • User account and logon context for launched processes or scripts
  • Script execution telemetry where collected
  • Host CPU and memory utilization over time
  • Windows service start, stop, failure, and crash events

Detection direction

  • Confirm that Windows endpoints and servers collect both process execution evidence and resource/performance data; one without the other may miss the decision context.
  • Build or tune detections around rapid CPU or memory exhaustion by recently launched user or script processes, especially when followed by service crash or failure events.
  • Use environment-specific baselines for high-resource administrative tools, scheduled tasks, patching, backup, indexing, and monitoring agents to reduce false positives.
  • Prioritize alert enrichment with user, host criticality, parent process, script source, affected service, and recent change activity.
  • Treat this analytic as a detection validation theme, not a complete rule, because the official ATT&CK detection field is not provided.

Mitigation priorities

  • Identify Windows systems where service crash or resource exhaustion would materially affect business operations.
  • Ensure critical services have appropriate monitoring, restart/recovery configuration, and incident runbooks.
  • Restrict and review who can run scripts or launch high-impact processes on sensitive Windows systems.
  • Apply least privilege and administrative control review for accounts able to interact with critical services.
  • Validate endpoint logging, performance monitoring, and retention so responders can reconstruct process-driven exhaustion events.
Analyst notes and limits

This object is an ATT&CK detection analytic, AN0584, for Windows. The supplied description centers on excessive resource exhaustion or service crash caused by user- or script-launched processes consuming CPU/memory or attempting malformed service interactions. No ATT&CK tactics, relationships, aliases, labels, or official detection text were supplied, so the take emphasizes defensive validation and operational resilience rather than threat attribution or technique mapping.

Assessment is limited to the provided STIX fields and external reference. No active exploitation, actor usage, malware usage, impact history, related techniques, or detection rule logic is supplied. Local environment baselines, asset criticality, logging configuration, and service architecture are required to determine priority and detection quality.

Official MITRE ATT&CK definition

Analytic 0584

Excessive resource exhaustion or service crash induced by processes launched by users or scripts that rapidly consume CPU/memory or attempt malformed service interactions.

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

Relationship explorer

All related ATT&CK context

No relationships are available in the current normalized data for this object.

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .

ATT&CK release
19.1
Object version
1.0
Created
Modified
Raw hash
407a224830d25af4...
Imported snapshots across ATT&CK releases (1)
Release Bundle imported Object version Modified Status Raw hash
19.1 1.0 Current bundle 407a224830d2…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    mitre-attack AN0584
    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.