tfMITRE ATT&CK sub-technique

Cloud Service Hijacking T1496.004

sub-technique of T1496 Resource Hijacking

Tactic: Impact
Platform: SaaS
Version: 1.0
Created: 25 September 2024
Last modified: 15 April 2025

Adversaries may leverage compromised software-as-a-service (SaaS) applications to complete resource-intensive tasks, which may impact hosted service availability.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsNone recorded

Threat groupsNone recorded · 29% of ATT&CK techniques have none either.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malwareNone recorded

Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.

Detection rulesNone recorded

Detection rulesNone recorded · 33% of ATT&CK techniques have none either.

Offense vs defense T1496.004

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

Cloud Service Hijacking detection strategy DET0147

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for Cloud Service Hijacking via SaaS Abuse

Enterprise

1 platform

AN0417 · SaaS

Adversary gains access to cloud-hosted services such as AWS SES, SNS, or OpenAI API, enables or modifies usage policies, and initiates resource-intensive actions (e.g., mass email/SMS or LLM queries), often from unauthorized regions or under anomalous identity conditions.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
User Account MetadataDC0013	AWS:CloudTrail	AssumeRole
Application Log ContentDC0038	AWS:CloudTrail	SendEmail
Cloud Service ModificationDC0069	AWS:CloudTrail	PutIdentityPolicy

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TimeWindow	Define threshold period over which request spikes are measured. E.g., 10 min or 1 hour windows.
UserContext	Alert only if role/user is outside expected automation identity list.
RequestVolumeThreshold	Customize the number of emails/SMS or API calls considered anomalous.
GeoVelocityThreshold	Tune geolocation jump logic (e.g., login from US, then use service in Asia within minutes).
ModelUsageQuotaSpike	Set maximum allowable deviation from past 7-day average OpenAI/GPT token usage.

Cloud Service Hijacking detections T1496.004

No detection rules are mapped to this technique yet.

None recorded— 33% of ATT&CK techniques have none either

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs