Techniques › T1496.003 › AN0443
AN0443 Analytic 0443
SaaS · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Automated and repetitive triggering of SMS messages through OTP/account verification fields on SaaS platforms, leveraging background messaging APIs such as Twilio, AWS SNS, or Amazon Cognito to generate traffic toward attacker-controlled numbers.</p>
- Detects
- T1496.003 SMS Pumping
- Part of
- DET0156 Detection Strategy for Resource Hijacking: SMS Pumping via SaaS Application Logs
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| saas:application | High-frequency invocation of SMS-related API endpoints from publicly accessible OTP or verification forms (e.g., Twilio: SendMessage, Cognito: AdminCreateUser) with irregular destination patterns. | DC0038 Application Log Content |
| saas:audit | Repeated requests to SMS-generating endpoints using anomalous or new user agents, IP ranges, or geographies. | DC0002 User Account Authentication |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
TimeWindow | Defines the rolling window over which SMS API invocation frequency is measured. Tunable based on average platform traffic. |
SMSFrequencyThreshold | Number of SMS requests per endpoint or per user that should trigger investigation. Should align with business logic and user behavior. |
DestinationCountryCodeFilter | Monitors if requests target known high-risk, revenue-sharing regions. Tunable to reflect SMS tariff rates or abuse history. |
UserAgentAnomalyThreshold | Defines outlier score or list of unknown/automated user agents submitting forms. |
IPGeoVarianceScore | Tracks abnormal geographic spread of traffic sourcing OTP triggers. |