tfMITRE ATT&CK sub-technique

Bandwidth Hijacking T1496.002

sub-technique of T1496 Resource Hijacking

Tactic: Impact
Platforms: Linux, Windows, macOS, IaaS, Containers
Version: 1.0
Created: 25 September 2024
Last modified: 15 April 2025

Adversaries may leverage the network bandwidth resources of co-opted systems to complete resource-intensive tasks, which may impact system and/or hosted service availability.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsNone recorded

Threat groupsNone recorded · 29% of ATT&CK techniques have none either.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malwareNone recorded

Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.

Detection rulesNone recorded

Detection rulesNone recorded · 33% of ATT&CK techniques have none either.

Offense vs defense T1496.002

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

Bandwidth Hijacking detection strategy DET0028

MITRE names one behaviour worth catching for this technique and breaks it into 5 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detect Excessive or Unauthorized Bandwidth Usage for Botnet, Proxyjacking, or Scanning Purposes

Enterprise

5 platforms

AN0080 · Windows

Processes invoking network-intensive child processes or uploading large data volumes, often from non-standard user or system contexts, with evidence of long-duration TCP/UDP sessions to unusual destinations.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
Network Connection CreationDC0082	WinEventLog:Sysmon	EventCode=3, 22

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TimeWindow	Bandwidth anomalies should be assessed over 5-15 min or hourly windows depending on environment size.
DestinationCountry	Some organizations whitelist traffic to countries based on geolocation.
ProcessName	Legitimate processes using high bandwidth (e.g., backup tools) must be excluded.

AN0081 · Linux

User-initiated processes generating sustained outbound traffic over common or non-standard ports, often outside business hours, potentially linked to scanning or proxyjacking. Includes curl, wget, masscan, or proxy clients.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	auditd:SYSCALL	execve calls with high-frequency or known bandwidth-intensive tools
Network Traffic FlowDC0078	NSM:Flow	large outbound data flows or long-duration connections

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ToolPattern	Can be tuned for specific bandwidth abuse tools (e.g., proxychains, 3proxy).
TrafficRateThreshold	Baseline deviation thresholds must be environment-specific.

AN0082 · macOS

Suspicious long-lived or high-throughput connections by non-Apple signed apps or processes not commonly associated with network uploads. Detect background processes using open sockets for data egress.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	macos:unifiedlog	exec or spawn calls to proxy tools or torrent clients
Network Traffic ContentDC0085	macos:unifiedlog	process + network metrics correlation for bandwidth saturation

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ProcessSignedStatus	Non-signed or non-Apple signed binaries can raise confidence levels.
DataRateThreshold	Observed data rate per process over time (e.g., MB/s).

AN0083 · Containers

Containerized apps or sidecar containers generating excessive outbound traffic or being leveraged for proxy networks. Includes sudden increases in network interface stats, especially in dormant or low-util apps.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	containers:osquery	bandwidth-intensive command execution from within a container namespace
Network Traffic ContentDC0085	docker:stats	unusual network TX/RX byte deltas

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ContainerBaselineNetworkUsage	Baseline per container must be defined by app purpose and normal traffic.
ImageName	Certain image names or registries may be prone to abuse (e.g., public image hosting mining or proxyware).

AN0084 · IaaS

Virtual instances or workloads generating sustained outbound data rates, often to TOR, VPN, or proxy endpoints. Often coincides with unusual IAM usage or deployed scripts (e.g., cron jobs using proxy clients).

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Network Traffic FlowDC0078	AWS:VPCFlowLogs	egress > 90th percentile or frequent connection reuse
Instance StartDC0080	AWS:CloudTrail	StartInstances

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
InstanceType	High-throughput instance types are more likely to be targeted for hijacking.
TrafficEgressThreshold	Customize detection thresholds based on cloud provider quotas or billing alerts.

Bandwidth Hijacking detections T1496.002

No detection rules are mapped to this technique yet.

None recorded— 33% of ATT&CK techniques have none either

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs