tfMITRE ATT&CK technique

Resource Hijacking T1496

Tactic: Impact
Platforms: Windows, IaaS, Linux, macOS, Containers, SaaS
Version: 2.0
Created: 17 April 2019
Last modified: 24 October 2025
Contributors: David Fiser, @anu4is, Trend Micro; Alfredo Oliveira, Trend Micro; Jay Chen, Palo Alto Networks; Magno Logan, @magnologan, Trend Micro; Vishwas Manral, McAfee; Yossi Weizman, Azure Defender Research Team; Menachem Goldstein

Sub-techniques 413 rules across the family · 13 mapped directly to T1496 · 0 of 4 carry rules

.001Compute Hijacking0 .002Bandwidth Hijacking0 .003SMS Pumping0 .004Cloud Service Hijacking0

Adversaries may leverage the resources of co-opted systems to complete resource-intensive tasks, which may impact system and/or hosted service availability.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsNone recorded

Threat groupsNone recorded · 29% of ATT&CK techniques have none either.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malwareNone recorded

Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.

Detection rulesTop 19%

Detection rules81st percentile · 81% of ATT&CK techniques have this many detection rules written or fewer.

Offense vs defense T1496

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 0Sigma rules (cumulative) · 13Splunk ESCU (cumulative) · 0

first rule: 2021 Q3

Resource Hijacking detection strategy DET0267

MITRE names one behaviour worth catching for this technique and breaks it into 6 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Resource Hijacking Detection Strategy

Enterprise

6 platforms

AN0741 · Windows

Persistent high CPU utilization combined with suspicious command-line execution (e.g., mining tools or obfuscated scripts) and outbound connections to mining/proxy networks.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Host StatusDC0018	Windows:perfmon	High sustained CPU usage by a single process
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
Network Connection CreationDC0082	WinEventLog:Sysmon	EventCode=3, 22

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TimeWindow	Duration threshold for sustained CPU activity (e.g., >15 minutes)
DestinationIPList	Known mining pool IPs or proxy service endpoints
ExecutableNamePatterns	Regex list of suspicious or known mining tools

AN0742 · Linux

Abnormal CPU/memory usage by unauthorized processes with outbound connections to known mining pools or using cron jobs/scripts to maintain persistence.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Host StatusDC0018	linux:procfs	Sustained high /proc/[pid]/stat usage
Process CreationDC0032	auditd:SYSCALL	execve
Network Traffic FlowDC0078	NSM:Flow	Outbound traffic to mining pools or proxies

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ProcessPath	Location of resource-heavy binaries (e.g., /tmp/.xmr)
CPUThreshold	Acceptable baseline for CPU overuse
KnownMiningDomains	List of domains/IPs for known cryptomining services

AN0743 · macOS

Background launch agents/daemons with high CPU use and network access to external mining services.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	macos:unifiedlog	launchctl activity and process creation
Network Traffic ContentDC0085	macos:unifiedlog	Persistent outbound traffic to mining domains

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
launchdLabel	Suspicious or unknown launch agents
TrafficVolumeThreshold	Outbound bandwidth usage thresholds

AN0744 · IaaS

Sudden spikes in cloud VM CPU usage with outbound traffic to mining pools and unauthorized instance creation.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Host StatusDC0018	AWS:CloudWatch	Sustained EC2 CPU usage above normal baseline
Network Traffic FlowDC0078	AWS:VPCFlowLogs	Outbound flow logs to known mining pools
Instance StartDC0080	AWS:CloudTrail	RunInstances

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
CPUUtilizationThreshold	CloudWatch alarm trigger for sustained CPU
UnusualRegionList	Instances launched in unexpected regions

AN0745 · Containers

High CPU usage by unauthorized containers running mining binaries or public proxy tools.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Host StatusDC0018	prometheus:metrics	Container CPU/Memory usage exceeding threshold
Process CreationDC0032	containerd:events	New container with suspicious image name or high resource usage
Network Traffic FlowDC0078	container:cni	Outbound network traffic to mining proxies

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ImageName	Suspicious or unknown container image used
CPUQuotaThreshold	Container-level resource limits

AN0746 · SaaS

Abuse of cloud messaging platforms to send mass spam or consume quota-based resources.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Application Log ContentDC0038	saas:application	High-volume API calls or traffic via messaging or webhook service
Cloud Service ModificationDC0069	m365:unified	SendMessage

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
MessageRateThreshold	Max allowable outbound message rate per user/account
APIKeyList	Known authorized API clients for messaging usage

Tests2Executorssh 1 · PowerShell 1Need elevation0 of 2Have prerequisites0Have cleanup0Platformslinux, macos, windows

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

FreeBSD/macOS/Linux - Simulate CPU Load with Yes

linux, macos

—

Windows - Simulate CPU Load with PowerShell

windows

PowerShell

—

This test simulates high CPU load using PowerShell, commonly seen in resource hijacking. Spawns background jobs to stress CPU cores for a specified duration.

Input arguments

Name	Type	Default	Description
cpu_threads	integer	4	Number of threads to stress (default 4)
duration_seconds	integer	30	Duration in seconds to run the CPU stress test

Attack command

$end = (Get-Date).AddSeconds(#{duration_seconds})
1..#{cpu_threads} | ForEach-Object { Start-Job { param($t) while((Get-Date) -lt $t) { $i=0; while($i -lt 200000){$i++} } } -ArgumentList $end }
Get-Job | Wait-Job | Remove-Job

GUID3c1cf2aa-839b-4048-9230-a77779df2c8c

Tests from Atomic Red Team (MIT licence) · technique definition

Resource Hijacking detections T1496

13 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

Top 19%of all ATT&CK techniques for number of rules

Product

(none) 1

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs