EXPLORE
← Back to Explore
T1496

Resource Hijacking

Adversaries may leverage the resources of co-opted systems to complete resource-intensive tasks, which may impact system and/or hosted service availability. Resource hijacking may take a number of different forms. For example, adversaries may: * Leverage compute resources in order to mine cryptocurrency * Sell network bandwidth to proxy networks * Generate SMS traffic for profit * Abuse cloud-based messaging services to send large quantities of spam messages In some cases, adversaries may le...

WindowsIaaSLinuxmacOSContainersSaaS
28
Detections
2
Sources
0
Threat Actors

BY SOURCE

15elastic13sigma

PROCEDURES (23)

Network Connection Monitoring4 detections

Auto-extracted: 4 detections for network connection monitoring

Process Creation Monitoring2 detections

Auto-extracted: 2 detections for process creation monitoring

Cloud Monitoring2 detections

Auto-extracted: 2 detections for cloud monitoring

Dns1 detections

Auto-extracted: 1 detections for dns

Suspicious1 detections

Auto-extracted: 1 detections for suspicious

Api1 detections

Auto-extracted: 1 detections for api

Container1 detections

Auto-extracted: 1 detections for container

Exfiltrat1 detections

Auto-extracted: 1 detections for exfiltrat

Api1 detections

Auto-extracted: 1 detections for api

Azure1 detections

Auto-extracted: 1 detections for azure

Kubernetes1 detections

Auto-extracted: 1 detections for kubernetes

Container1 detections

Auto-extracted: 1 detections for container

Azure1 detections

Auto-extracted: 1 detections for azure

Service1 detections

Auto-extracted: 1 detections for service

Email1 detections

Auto-extracted: 1 detections for email

Dns1 detections

Auto-extracted: 1 detections for dns

Token1 detections

Auto-extracted: 1 detections for token

Aws1 detections

Auto-extracted: 1 detections for aws

Exfiltrat1 detections

Auto-extracted: 1 detections for exfiltrat

Service1 detections

Auto-extracted: 1 detections for service

Exfiltrat1 detections

Auto-extracted: 1 detections for exfiltrat

General Monitoring1 detections

Auto-extracted: 1 detections for general monitoring

Token1 detections

Auto-extracted: 1 detections for token

DETECTIONS (28)

Anthropic Excessive Chat Creation
elasticmedium
Anthropic Extra Usage Spend Limit Deleted
elasticmedium
AWS Bedrock Provisioned Model Throughput Tampering
elasticmedium
AWS Lambda Function High-Frequency Invocation by a Single Principal
elasticmedium
AWS Potential Cryptomining via ECS Task Definition Deployment
elastichigh
AWS SNS Rare Protocol Subscription by User
elasticlow
AWS SNS Topic Created by Rare User
elasticlow
AWS SNS Topic Message Publish by Rare User
elastichigh
Azure Container Registry Created or Deleted
sigmalow
Azure Kubernetes Cluster Created or Deleted
sigmalow
Azure Kubernetes Network Policy Change
sigmamedium
Azure Kubernetes RoleBinding/ClusterRoleBinding Modified and Deleted
sigmamedium
Azure Kubernetes Secret or Config Object Access
sigmamedium
Azure Kubernetes Sensitive Role Access
sigmamedium
Azure Kubernetes Service Account Modified or Deleted
sigmamedium
DNS Events Related To Mining Pools
sigmalow
GCP Vertex AI High Request and Token Volume
elasticmedium
Linux Crypto Mining Indicators
sigmahigh
Linux Crypto Mining Pool Connections
sigmahigh
Memory Swap Modification
elasticmedium
Microsoft Foundry High Request and Token Volume
elasticmedium
Monero Crypto Coin Mining Pool Lookup
sigmahigh
Network Communication With Crypto Mining Pool
sigmahigh
Newly Observed Process Exhibiting High CPU Usage
elastichigh
Potential Crypto Mining Activity
sigmahigh
Potential Malware-Driven SSH Brute Force Attempt
elasticmedium
Potential Redis CONFIG SET Cron Directory Persistence (RedisRaider)
elastichigh
Suspicious Mining Process Creation Event
elasticmedium