Attack scenario
API resource and cost exhaustion
An adversary abuses expensive API operations, large inputs, or paid services to exhaust CPU, memory, storage, connectivity, or financial limits.
Why this scenario matters
The attack may not resemble volumetric DDoS. Repeated expensive search, export, document generation, SMS, email, biometric verification, or cloud-function calls can cause unavailability or unexpected cost.
Controls should include size and rate limits, identity- and business-operation quotas, timeouts, cost controls, bot protection, capacity telemetry, and safe asynchronous processing.
The scenario uses MITRE ATT&CK® as a reference model. It is an expert SecTec interpretation and does not imply endorsement by MITRE.
Relevant ATT&CK tactics
- Collection
- Impact
Relevant ATT&CK techniques
Reference frameworks
SecTec technologies and vendors
The following hierarchy is derived from the approved ATT&CK-to-technology and technology-to-vendor mappings.