Adversaries may leverage the resources of co-opted systems to complete resource-intensive tasks, which may impact system and/or hosted service availability.
Resource hijacking may take a number of different forms. For example, adversaries may:
* Leverage compute resources in order to mine cryptocurrency
* Sell network bandwidth to proxy networks
* Generate SMS traffic for profit
* Abuse cloud-based messaging services to send large quantities of spam messages
In some cases, adversaries may leverage multiple types of Resource Hijacking at once.[1]
MITRE names one behaviour worth catching for this technique and breaks it into 6 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Resource Hijacking Detection Strategy
Enterprise
6 platforms
AN0741 · Windows
Persistent high CPU utilization combined with suspicious command-line execution (e.g., mining tools or obfuscated scripts) and outbound connections to mining/proxy networks.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
Field
What you tune
TimeWindow
Duration threshold for sustained CPU activity (e.g., >15 minutes)
DestinationIPList
Known mining pool IPs or proxy service endpoints
ExecutableNamePatterns
Regex list of suspicious or known mining tools
AN0742 · Linux
Abnormal CPU/memory usage by unauthorized processes with outbound connections to known mining pools or using cron jobs/scripts to maintain persistence.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
Field
What you tune
MessageRateThreshold
Max allowable outbound message rate per user/account
APIKeyList
Known authorized API clients for messaging usage
Tests2Executorssh 1 · powershell 1Need elevation0 of 2Have prerequisites0Have cleanup0Platformslinux, macos, windows
#
Test
Platform
Executor
Elevation
Prereqs
Cleanup
Ref
01
FreeBSD/macOS/Linux - Simulate CPU Load with Yes
linux, macos
sh
—
—
—
This test simulates a high CPU load as you might observe during cryptojacking attacks.
End the test by using CTRL/CMD+C to break.
Attack Commandsrun with sh
yes > /dev/null
GUID904a5a0e-fb02-490d-9f8d-0e256eb37549
02
Windows - Simulate CPU Load with PowerShell
windows
powershell
—
—
—
This test simulates high CPU load using PowerShell, commonly seen in resource hijacking.
Spawns background jobs to stress CPU cores for a specified duration.