T1496 · Resource Hijacking

Sunturai

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice

T1496 · Resource Hijacking · Sunturai

attack-patternenterprise-attackT1496

Resource Hijacking

attack-pattern--cd25c1b4-935c-4f0e-ba8d-552f28bc4783

Adversaries may leverage the resources of co-opted systems to complete resource-intensive tasks, which may impact system and/or hosted service availability. Resource hijacking may take a number of different forms. For example, adversaries may: * Leverage compute resources in order to mine cryptocurrency * Sell network bandwidth to proxy networks * Generate SMS traffic for profit * Abuse cloud-based messaging services to send large quantities of spam messages In some cases, adversaries may leverage multiple types of Resource Hijacking at once.(Citation: Sysdig Cryptojacking Proxyjacking 2023)

Created: Apr 17, 2019, 2:50 PM UTC
Modified: Oct 24, 2025, 5:49 PM UTC

4 sub-techniques under this technique

Each is its own technique in the catalogue, with its own detections.

67 published detections cover this technique

Every one carries the source it came from and the licence it was published under.

Detections covering this technique
Detection	Severity	Source	Published	Licence
GCP Vertex AI High Request and Token Volume	Medium	Elastic detection rules	Oct 8, 2026	Elastic License 2.0
Microsoft Foundry High Request and Token Volume	Medium	Elastic detection rules	Oct 6, 2026	Elastic License 2.0
AWS Bedrock Provisioned Model Throughput Tampering	Medium	Elastic detection rules	Oct 2, 2026	Elastic License 2.0
Anthropic Extra Usage Spend Limit Deleted	Medium	Elastic detection rules	Oct 2, 2026	Elastic License 2.0
Anthropic Excessive Chat Creation	Medium	Elastic detection rules	Oct 2, 2026	Elastic License 2.0
Potential Redis CONFIG SET Cron Directory Persistence (RedisRaider)	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Potential Malware-Driven SSH Brute Force Attempt	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Memory Swap Modification	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Suspicious Mining Process Creation Event	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
AWS SNS Topic Created by Rare User	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
AWS SNS Topic Message Publish by Rare User	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
AWS Lambda Function High-Frequency Invocation by a Single Principal	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
AWS Potential Cryptomining via ECS Task Definition Deployment	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
AWS SNS Rare Protocol Subscription by User	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Newly Observed Process Exhibiting High CPU Usage	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Cisco Cloud Security - Crypto Miner User-Agent Detected	Medium	—	Sep 4, 2026	MIT License
A host is potentially running a crypto miner (ASIM Web Session schema)	Medium	Microsoft Sentinel analytics	Sep 2, 2026	MIT License
DNS events related to mining pools (ASIM DNS Schema)	Low	Microsoft Sentinel analytics	Sep 2, 2026	MIT License
DNS Domains linked to WannaCry ransomware campaign	Unknown	Microsoft Sentinel analytics	Sep 1, 2026	MIT License
NRT DNS events related to mining pools	Low	Microsoft Sentinel analytics	Sep 1, 2026	MIT License
DNS events related to mining pools	Low	Microsoft Sentinel analytics	Sep 1, 2026	MIT License
Chia_Crypto_Mining IOC - June 2021	Low	Microsoft Sentinel analytics	Sep 1, 2026	MIT License
VMware ESXi - List of virtual disks (images)	Low	Microsoft Sentinel analytics	Sep 1, 2026	MIT License
VMware ESXi - Unexpected disk image	Medium	Microsoft Sentinel analytics	Sep 1, 2026	MIT License
OCI - Multiple instances launched	Medium	Microsoft Sentinel analytics	Sep 1, 2026	MIT License

Showing 25 of 67

Filter in the catalogue

External references

mitre-attackT1496Open reference

Sysdig Cryptojacking Proxyjacking 2023Open reference

Platforms

ContainersIaaSLinuxmacOSSaaSWindows

Kill chain phases

impact

Relationships

Incoming and outgoing edges in the selected ATT&CK release.

Incoming and outgoing edges in the selected ATT&CK release
Direction	Type	Related object