Techniques › T1496 › AN0741
AN0741 Analytic 0741
Windows · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Persistent high CPU utilization combined with suspicious command-line execution (e.g., mining tools or obfuscated scripts) and outbound connections to mining/proxy networks.</p>
- Detects
- T1496 Resource Hijacking
- Part of
- DET0267 Resource Hijacking Detection Strategy
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| WinEventLog:Sysmon | EventCode=1 | DC0032 Process Creation |
| Windows:perfmon | High sustained CPU usage by a single process | DC0018 Host Status |
| WinEventLog:Sysmon | EventCode=3, 22 | DC0082 Network Connection Creation |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
TimeWindow | Duration threshold for sustained CPU activity (e.g., >15 minutes) |
DestinationIPList | Known mining pool IPs or proxy service endpoints |
ExecutableNamePatterns | Regex list of suspicious or known mining tools |
KEV CVEs whose mapped technique this analytic detects
| CVE | Vendor / product | State |
|---|---|---|
| CVE-2017-9822 | DotNetNuke (DNN) DotNetNuke (DNN) | Mapped |
| CVE-2018-11776 | Apache Struts | Mapped |
| CVE-2018-7600 | Drupal Drupal Core | Mapped |
| CVE-2019-18935 | Progress Telerik UI for ASP.NET AJAX | Mapped |
| CVE-2020-8515 | DrayTek Multiple Vigor Routers | Mapped |
| CVE-2021-22205 | GitLab Community and Enterprise Editions | Mapped |
| CVE-2021-26084 | Atlassian Confluence Server and Data Center | Mapped |
| CVE-2021-35394 | Realtek Jungle Software Development Kit (SDK) | Mapped |
| CVE-2021-44228 | Apache Log4j2 | Mapped |
| CVE-2022-29303 | SolarView Compact | Mapped |
| CVE-2022-29464 | WSO2 Multiple Products | Mapped |
| CVE-2023-1389 | TP-Link Archer AX21 | Mapped |
| CVE-2023-22527 | Atlassian Confluence Data Center and Server | Mapped |
| CVE-2023-32315 | Ignite Realtime Openfire | Mapped |
| CVE-2023-38035 | Ivanti Sentry | Mapped |
| CVE-2023-47565 | QNAP VioStor NVR | Mapped |
| CVE-2023-49897 | FXC AE1021, AE1021PE | Mapped |
| CVE-2024-23692 | Rejetto HTTP File Server | Mapped |
| CVE-2025-4632 | Samsung MagicINFO 9 Server | Mapped |