tfMITRE ATT&CK sub-technique

Compute Hijacking T1496.001

sub-technique of T1496 Resource Hijacking

Tactic: Impact
Platforms: Windows, IaaS, Linux, macOS, Containers
Version: 1.0
Created: 25 September 2024
Last modified: 15 April 2025

Adversaries may leverage the compute resources of co-opted systems to complete resource-intensive tasks, which may impact system and/or hosted service availability.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups70th pct

Threat groups70th percentile · 70% of ATT&CK techniques have this many threat groups attributed or fewer.

Campaigns72nd pct

Campaigns72nd percentile · 72% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malware73rd pct

Tools & malware73rd percentile · 73% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rulesNone recorded

Detection rulesNone recorded · 33% of ATT&CK techniques have none either.

Compute Hijacking MITRE reference T1496.001

70th pctamong all ATT&CK techniques for number of groups

4 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

TeamTNTG0139 ↗

Has deployed XMRig Docker images to mine cryptocurrency.1 2 TeamTNT has also infected Docker containers and Kubernetes clusters with XMRig, and used RainbowMiner and lolMiner for mining cryptocurrency.3

created 2021-10-013 references

Blue MockingbirdG0108 ↗

Has used XMRIG to mine cryptocurrency on victim systems.1

created 2020-05-261 reference

RockeG0106 ↗

Has distributed cryptomining malware.1 2

created 2020-05-262 references

APT41G0096 ↗

Deployed a Monero cryptocurrency mining tool in a victim’s environment.1 2

created 2019-09-232 referencesaka Wicked Panda

All 4 groups for this technique

Offense vs defense T1496.001

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

Compute Hijacking detection strategy DET0540

MITRE names one behaviour worth catching for this technique and breaks it into 5 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Multi-Platform Behavioral Detection for Compute Hijacking

Enterprise

5 platforms

AN1489 · Windows

Sustained execution of resource-intensive processes (e.g., cryptocurrency miners), often launched via scheduled tasks, WMI, or PowerShell. These processes frequently establish persistent external connections and attempt to evade detection using masqueraded or renamed binaries.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Scheduled Job CreationDC0001	WinEventLog:Security	EventCode=4698
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
Network Connection CreationDC0082	WinEventLog:Sysmon	EventCode=3, 22

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
Image	The executable name of the miner or wrapper—can vary across campaigns.
DestinationIP	May differ depending on the mining pool or proxy server.
ParentProcessName	Useful for filtering known-good automation vs malicious task runners.

AN1490 · Linux

Unusual long-running processes consuming high CPU cycles (e.g., via 'top' or 'ps') initiated via cron, shell scripts, or Docker. Connections to known mining pools or DNS over HTTPS usage as evasion.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Scheduled Job CreationDC0001	linux:cron	Scheduled execution of unknown or unusual script/binary
Process CreationDC0032	auditd:SYSCALL	execve
Network Traffic FlowDC0078	NSM:Flow	Outbound connection to mining pool port (3333, 4444, 5555)

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
CommandLine	The miner's execution path and options may vary by campaign.
CPUThreshold	Environment-specific definition of anomalous CPU usage.

AN1491 · macOS

Persistent or background daemons (e.g., plist or launchd jobs) spawning high-CPU processes like xmrig or cpuminer. Outbound encrypted traffic to IPs/domains commonly used by mining proxies.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	macos:unifiedlog	launchd or cron spawning mining binaries
Network Traffic ContentDC0085	macos:unifiedlog	Persistent outbound connections with consistent periodicity

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
launchd.plist_label	May be disguised with benign-looking names.
DestinationDomain	Varying mining pool or obfuscated destination.

AN1492 · Containers

Ephemeral or unauthorized container instantiation using public images (e.g., from DockerHub) that initiate high CPU usage shortly after startup. Often scheduled via Kubernetes or Docker socket abuse.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	auditd:SYSCALL	execve
Container CreationDC0072	containerd:events	create
Network Traffic FlowDC0078	NSM:Flow	Outbound traffic to mining pool upon container launch

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ImageSource	May vary depending on where the image is pulled from (registry or custom URL).
Namespace	Helps differentiate attacker-created namespaces.

AN1493 · IaaS

Unauthorized instance creation in unmonitored or unused regions. Burst of compute-intensive jobs in spot instances or sudden spike in resource usage in legitimate VMs.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Host StatusDC0018	AWS:CloudWatch	Unusual CPU burst or metric anomalies
Instance StartDC0080	AWS:CloudTrail	RunInstances

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
Region	Adversaries may deploy resources in rarely used or misconfigured regions.
TagKey	Used to evade detection with benign-looking tags or names.

Compute Hijacking detections T1496.001

No detection rules are mapped to this technique yet.

None recorded— 33% of ATT&CK techniques have none either

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs