AN0850: Analytic 0850
Exploitation of system or application vulnerability (e.g., CVE-based exploit) followed by service crash, restart, or repeated failure within a short time frame, impacting application/system availability.
Analyst context for executives and security teams
AN0850 describes a Windows-focused detection analytic concept for spotting when exploitation of a system or application vulnerability is followed by a service crash, restart, or repeated failure in a short period. The business value is availability-focused: even when exploitation details are unclear, crash-and-restart patterns after vulnerability activity can be an early signal that a critical application or host is unstable and needs incident response and vulnerability management attention.
Executive priority
Prioritize this as an operational resilience and vulnerability response use case. Leaders should ask whether critical Windows services and applications have telemetry that can prove when exploitation-like activity is followed by failures, and whether SOC, IR, and vulnerability teams have a defined handoff for triaging availability-impacting crashes. This analytic is especially useful for deciding whether an outage pattern should be treated as routine reliability noise or as a potential security incident requiring containment, patch prioritization, and audit evidence preservation.
Technical view
For SOC and detection engineering teams, validate whether Windows service failure, application crash, restart, and repeated-failure events can be correlated with vulnerability-exploitation indicators in a short time window. Because ATT&CK provides no official detection logic, tactic mapping, or relationship context for this analytic, teams should define local correlation rules around protected Windows assets, critical applications, and known vulnerability exposure. IR teams should preserve crash artifacts, service control events, application/system logs, and vulnerability context to determine whether the failure pattern is security-relevant or operational.
Likely telemetry
- Windows System and Application event logs showing service crashes, restarts, or repeated failures
- Service Control Manager events and service recovery activity
- Application crash reports, faulting module data, and error reporting artifacts
- Endpoint detection and response alerts or process telemetry near the failure window
- Vulnerability management records showing exposed or unpatched Windows systems or applications
Detection direction
- Correlate exploit-related security signals with service crash, restart, or repeated failure events within a short time frame.
- Tune around business-critical Windows services and applications where availability impact is material.
- Suppress or annotate known maintenance windows, patch cycles, controlled restarts, and unstable legacy applications to reduce false positives.
- Look for repeated failure patterns rather than a single crash when local baselines show frequent benign application instability.
- Validate that detection coverage includes both security telemetry and reliability telemetry; many SOC gaps occur when crash data stays only with infrastructure or application teams.
Mitigation priorities
- Inventory critical Windows-hosted services and applications and confirm owners, logging, and escalation paths.
- Prioritize vulnerability remediation for exposed systems where exploitation could affect service availability.
- Ensure service crash and restart telemetry is retained long enough for incident reconstruction and compliance evidence.
- Define SOC-to-IR-to-vulnerability-management workflow for crash patterns that coincide with exploit indicators.
- Use maintenance and change-management context to separate expected restarts from abnormal failure loops.
Analyst notes and limits
This object is a detection analytic, not a technique. The supplied ATT&CK fields describe a behavior pattern: vulnerability exploitation followed by Windows service or application availability degradation. The decision value is in correlating security context with reliability events so teams do not miss exploitation attempts that first appear as crashes or repeated service failures.
MITRE provides no official detection logic, tactics, relationships, aliases, or supporting references beyond the ATT&CK analytic URL. This take is therefore limited to the supplied Windows platform and description. Local asset criticality, vulnerability exposure, baseline crash rates, and available telemetry are required before determining detection quality or incident severity.
Analytic 0850
Exploitation of system or application vulnerability (e.g., CVE-based exploit) followed by service crash, restart, or repeated failure within a short time frame, impacting application/system availability.
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
All related ATT&CK context
No relationships are available in the current normalized data for this object.
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.0 | Current bundle | e0831c7395db… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
mitre-attack AN0850Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.