{"id":"T1496","name":"Resource Hijacking","url":"https://attack.mitre.org/techniques/T1496","tactics":["impact"],"platforms":["Windows","IaaS","Linux","macOS","Containers","SaaS"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0267","stix_id":"x-mitre-detection-strategy--440ddaf2-4e80-4699-90d7-0bdccdfeece6","name":"Resource Hijacking Detection Strategy","url":"https://attack.mitre.org/detectionstrategies/DET0267","analytics":[{"id":"AN0741","stix_id":"x-mitre-analytic--a789e535-cab9-49b4-9685-c10a5d3642b4","name":"Analytic 0741","description":"Persistent high CPU utilization combined with suspicious command-line execution (e.g., mining tools or obfuscated scripts) and outbound connections to mining/proxy networks.","url":"https://attack.mitre.org/detectionstrategies/DET0267#AN0741","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"},{"name":"Windows:perfmon","channel":"High sustained CPU usage by a single process","data_component":"DC0018","data_component_name":"Host Status","log_source_slug":"windows-perfmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=3, 22","data_component":"DC0082","data_component_name":"Network Connection Creation","log_source_slug":"wineventlog-sysmon"}],"mutable_elements":[{"field":"TimeWindow","description":"Duration threshold for sustained CPU activity (e.g., >15 minutes)"},{"field":"DestinationIPList","description":"Known mining pool IPs or proxy service endpoints"},{"field":"ExecutableNamePatterns","description":"Regex list of suspicious or known mining tools"}],"live":true,"detection_strategies":["DET0267"],"techniques":["T1496"]},{"id":"AN0742","stix_id":"x-mitre-analytic--7d099bc4-1a19-4aa3-b12b-a9390e98408a","name":"Analytic 0742","description":"Abnormal CPU/memory usage by unauthorized processes with outbound connections to known mining pools or using cron jobs/scripts to maintain persistence.","url":"https://attack.mitre.org/detectionstrategies/DET0267#AN0742","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"execve","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"auditd-syscall"},{"name":"linux:procfs","channel":"Sustained high /proc/[pid]/stat usage","data_component":"DC0018","data_component_name":"Host Status","log_source_slug":"linux-procfs"},{"name":"NSM:Flow","channel":"Outbound traffic to mining pools or proxies","data_component":"DC0078","data_component_name":"Network Traffic Flow","log_source_slug":"nsm-flow"}],"mutable_elements":[{"field":"ProcessPath","description":"Location of resource-heavy binaries (e.g., /tmp/.xmr)"},{"field":"CPUThreshold","description":"Acceptable baseline for CPU overuse"},{"field":"KnownMiningDomains","description":"List of domains/IPs for known cryptomining services"}],"live":true,"detection_strategies":["DET0267"],"techniques":["T1496"]},{"id":"AN0743","stix_id":"x-mitre-analytic--8cbeecbb-429f-4f30-9f42-266aaa7b2c0f","name":"Analytic 0743","description":"Background launch agents/daemons with high CPU use and network access to external mining services.","url":"https://attack.mitre.org/detectionstrategies/DET0267#AN0743","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"launchctl activity and process creation","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"macos-unifiedlog"},{"name":"macos:unifiedlog","channel":"Persistent outbound traffic to mining domains","data_component":"DC0085","data_component_name":"Network Traffic Content","log_source_slug":"macos-unifiedlog"}],"mutable_elements":[{"field":"launchdLabel","description":"Suspicious or unknown launch agents"},{"field":"TrafficVolumeThreshold","description":"Outbound bandwidth usage thresholds"}],"live":true,"detection_strategies":["DET0267"],"techniques":["T1496"]},{"id":"AN0744","stix_id":"x-mitre-analytic--8e1872c2-906c-4cf8-b0c7-afd448fe1c0b","name":"Analytic 0744","description":"Sudden spikes in cloud VM CPU usage with outbound traffic to mining pools and unauthorized instance creation.","url":"https://attack.mitre.org/detectionstrategies/DET0267#AN0744","platforms":["IaaS"],"log_source_references":[{"name":"AWS:CloudTrail","channel":"RunInstances","data_component":"DC0080","data_component_name":"Instance Start","log_source_slug":"aws-cloudtrail"},{"name":"AWS:CloudWatch","channel":"Sustained EC2 CPU usage above normal baseline","data_component":"DC0018","data_component_name":"Host Status","log_source_slug":"aws-cloudwatch"},{"name":"AWS:VPCFlowLogs","channel":"Outbound flow logs to known mining pools","data_component":"DC0078","data_component_name":"Network Traffic Flow","log_source_slug":"aws-vpcflowlogs"}],"mutable_elements":[{"field":"CPUUtilizationThreshold","description":"CloudWatch alarm trigger for sustained CPU"},{"field":"UnusualRegionList","description":"Instances launched in unexpected regions"}],"live":true,"detection_strategies":["DET0267"],"techniques":["T1496"]},{"id":"AN0745","stix_id":"x-mitre-analytic--791ea4ff-7a49-4aa7-a41c-51288031e0f0","name":"Analytic 0745","description":"High CPU usage by unauthorized containers running mining binaries or public proxy tools.","url":"https://attack.mitre.org/detectionstrategies/DET0267#AN0745","platforms":["Containers"],"log_source_references":[{"name":"containerd:events","channel":"New container with suspicious image name or high resource usage","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"containerd-events"},{"name":"prometheus:metrics","channel":"Container CPU/Memory usage exceeding threshold","data_component":"DC0018","data_component_name":"Host Status","log_source_slug":"prometheus-metrics"},{"name":"container:cni","channel":"Outbound network traffic to mining proxies","data_component":"DC0078","data_component_name":"Network Traffic Flow","log_source_slug":"container-cni"}],"mutable_elements":[{"field":"ImageName","description":"Suspicious or unknown container image used"},{"field":"CPUQuotaThreshold","description":"Container-level resource limits"}],"live":true,"detection_strategies":["DET0267"],"techniques":["T1496"]},{"id":"AN0746","stix_id":"x-mitre-analytic--6e5bfc6b-3f07-426b-ac9f-6a8cc6b591c3","name":"Analytic 0746","description":"Abuse of cloud messaging platforms to send mass spam or consume quota-based resources.","url":"https://attack.mitre.org/detectionstrategies/DET0267#AN0746","platforms":["SaaS"],"log_source_references":[{"name":"m365:unified","channel":"SendMessage","data_component":"DC0069","data_component_name":"Cloud Service Modification","log_source_slug":"m365-unified"},{"name":"saas:application","channel":"High-volume API calls or traffic via messaging or webhook service","data_component":"DC0038","data_component_name":"Application Log Content","log_source_slug":"saas-application"}],"mutable_elements":[{"field":"MessageRateThreshold","description":"Max allowable outbound message rate per user/account"},{"field":"APIKeyList","description":"Known authorized API clients for messaging usage"}],"live":true,"detection_strategies":["DET0267"],"techniques":["T1496"]}],"live":true,"version":"1.0","techniques":["T1496"]}],"sigma_rules":[{"id":"08d6ac24-c927-4469-b3b7-2e422d6e3c43","title":"Azure Kubernetes Network Policy Change","author":"Austin Songer @austinsonger","status":"test","level":"medium","date":"2021-08-07","modified":"2022-08-23","description":"Identifies when a Azure Kubernetes network policy is modified or deleted.","references":["https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes","https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/","https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/","https://medium.com/mitre-engenuity/att-ck-for-containers-now-available-4c2359654bf1"],"logsource":{"product":"azure","service":"activitylogs"},"tags":["attack.impact","attack.credential-access","attack.t1485","attack.t1496","attack.t1489"],"path":"rules/cloud/azure/activity_logs/azure_kubernetes_network_policy_change.yml","techniques":["T1485","T1496","T1489"],"cves":[]},{"id":"12d027c3-b48c-4d9d-8bb6-a732200034b2","title":"Azure Kubernetes Service Account Modified or Deleted","author":"Austin Songer @austinsonger","status":"test","level":"medium","date":"2021-08-07","modified":"2022-08-23","description":"Identifies when a service account is modified or deleted.","references":["https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes","https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/","https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/","https://medium.com/mitre-engenuity/att-ck-for-containers-now-available-4c2359654bf1"],"logsource":{"product":"azure","service":"activitylogs"},"tags":["attack.impact","attack.t1531","attack.t1485","attack.t1496","attack.t1489"],"path":"rules/cloud/azure/activity_logs/azure_kubernetes_service_account_modified_or_deleted.yml","techniques":["T1531","T1485","T1496","T1489"],"cves":[]},{"id":"25cb259b-bbdc-4b87-98b7-90d7c72f8743","title":"Azure Kubernetes RoleBinding/ClusterRoleBinding Modified and Deleted","author":"Austin Songer @austinsonger","status":"test","level":"medium","date":"2021-08-07","modified":"2022-08-23","description":"Detects the creation or patching of potential malicious RoleBinding/ClusterRoleBinding.","references":["https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes","https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/","https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/","https://medium.com/mitre-engenuity/att-ck-for-containers-now-available-4c2359654bf1"],"logsource":{"product":"azure","service":"activitylogs"},"tags":["attack.impact","attack.credential-access","attack.t1485","attack.t1496","attack.t1489"],"path":"rules/cloud/azure/activity_logs/azure_kubernetes_rolebinding_modified_or_deleted.yml","techniques":["T1485","T1496","T1489"],"cves":[]},{"id":"66c3b204-9f88-4d0a-a7f7-8a57d521ca55","title":"Potential Crypto Mining Activity","author":"Florian Roth (Nextron Systems)","status":"stable","level":"high","date":"2021-10-26","modified":"2023-02-13","description":"Detects command line parameters or strings often used by crypto miners","references":["https://www.poolwatch.io/coin/monero"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.impact","attack.t1496"],"path":"rules/windows/process_creation/proc_creation_win_susp_crypto_mining_monero.yml","techniques":["T1496"],"cves":[]},{"id":"7ee0b4aa-d8d4-4088-b661-20efdf41a04c","title":"Azure Kubernetes Secret or Config Object Access","author":"Austin Songer @austinsonger","status":"test","level":"medium","date":"2021-08-07","modified":"2022-08-23","description":"Identifies when a Kubernetes account access a sensitive objects such as configmaps or secrets.","references":["https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes","https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/","https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/","https://medium.com/mitre-engenuity/att-ck-for-containers-now-available-4c2359654bf1"],"logsource":{"product":"azure","service":"activitylogs"},"tags":["attack.impact","attack.t1485","attack.t1496","attack.t1489"],"path":"rules/cloud/azure/activity_logs/azure_kubernetes_secret_or_config_object_access.yml","techniques":["T1485","T1496","T1489"],"cves":[]},{"id":"818fee0c-e0ec-4e45-824e-83e4817b0887","title":"Azure Kubernetes Sensitive Role Access","author":"Austin Songer @austinsonger","status":"test","level":"medium","date":"2021-08-07","modified":"2022-08-23","description":"Identifies when ClusterRoles/Roles are being modified or deleted.","references":["https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes","https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/","https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/","https://medium.com/mitre-engenuity/att-ck-for-containers-now-available-4c2359654bf1"],"logsource":{"product":"azure","service":"activitylogs"},"tags":["attack.impact","attack.t1485","attack.t1496","attack.t1489"],"path":"rules/cloud/azure/activity_logs/azure_kubernetes_role_access.yml","techniques":["T1485","T1496","T1489"],"cves":[]},{"id":"9069ea3c-b213-4c52-be13-86506a227ab1","title":"Linux Crypto Mining Indicators","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2021-10-26","modified":"2022-12-25","description":"Detects command line parameters or strings often used by crypto miners","references":["https://www.poolwatch.io/coin/monero"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.impact","attack.t1496"],"path":"rules/linux/process_creation/proc_creation_lnx_crypto_mining.yml","techniques":["T1496"],"cves":[]},{"id":"93e0ef48-37c8-49ed-a02c-038aab23628e","title":"Azure Container Registry Created or Deleted","author":"Austin Songer @austinsonger","status":"test","level":"low","date":"2021-08-07","modified":"2022-08-23","description":"Detects when a Container Registry is created or deleted.","references":["https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes","https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/","https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/","https://medium.com/mitre-engenuity/att-ck-for-containers-now-available-4c2359654bf1"],"logsource":{"product":"azure","service":"activitylogs"},"tags":["attack.impact","attack.t1485","attack.t1496","attack.t1489"],"path":"rules/cloud/azure/activity_logs/azure_container_registry_created_or_deleted.yml","techniques":["T1485","T1496","T1489"],"cves":[]},{"id":"9541f321-7cba-4b43-80fc-fbd1fb922808","title":"Azure Kubernetes Cluster Created or Deleted","author":"Austin Songer @austinsonger","status":"test","level":"low","date":"2021-08-07","modified":"2022-08-23","description":"Detects when a Azure Kubernetes Cluster is created or deleted.","references":["https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes","https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/","https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/","https://medium.com/mitre-engenuity/att-ck-for-containers-now-available-4c2359654bf1"],"logsource":{"product":"azure","service":"activitylogs"},"tags":["attack.impact","attack.t1485","attack.t1496","attack.t1489"],"path":"rules/cloud/azure/activity_logs/azure_kubernetes_cluster_created_or_deleted.yml","techniques":["T1485","T1496","T1489"],"cves":[]},{"id":"a46c93b7-55ed-4d27-a41b-c259456c4746","title":"Linux Crypto Mining Pool Connections","author":"Florian Roth (Nextron Systems)","status":"stable","level":"high","date":"2021-10-26","modified":null,"description":"Detects process connections to a Monero crypto mining pool","references":["https://www.poolwatch.io/coin/monero"],"logsource":{"product":"linux","category":"network_connection"},"tags":["attack.impact","attack.t1496"],"path":"rules/linux/network_connection/net_connection_lnx_crypto_mining_indicators.yml","techniques":["T1496"],"cves":[]},{"id":"b593fd50-7335-4682-a36c-4edcb68e4641","title":"Monero Crypto Coin Mining Pool Lookup","author":"Florian Roth (Nextron Systems)","status":"stable","level":"high","date":"2021-10-24","modified":null,"description":"Detects suspicious DNS queries to Monero mining pools","references":["https://www.nextron-systems.com/2021/10/24/monero-mining-pool-fqdns/"],"logsource":{"category":"dns"},"tags":["attack.impact","attack.t1496","attack.exfiltration","attack.t1567"],"path":"rules/network/dns/net_dns_pua_cryptocoin_mining_xmr.yml","techniques":["T1496","T1567"],"cves":[]},{"id":"bf74135c-18e8-4a72-a926-0e4f47888c19","title":"DNS Events Related To Mining Pools","author":"Saw Winn Naung, Azure-Sentinel, @neu5ron","status":"test","level":"low","date":"2021-08-19","modified":"2022-07-07","description":"Identifies clients that may be performing DNS lookups associated with common currency mining pools.","references":["https://github.com/Azure/Azure-Sentinel/blob/fa0411f9424b6c47b4d5a20165e4f1b168c1f103/Detections/ASimDNS/imDNS_Miners.yaml"],"logsource":{"product":"zeek","service":"dns"},"tags":["attack.execution","attack.t1569.002","attack.impact","attack.t1496"],"path":"rules/network/zeek/zeek_dns_mining_pools.yml","techniques":["T1569.002","T1496"],"cves":[]},{"id":"fa5b1358-b040-4403-9868-15f7d9ab6329","title":"Network Communication With Crypto Mining Pool","author":"Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)","status":"stable","level":"high","date":"2021-10-26","modified":"2026-07-24","description":"Detects initiated network connections to crypto mining pools.\nIt indicates that the system is likely infected with a crypto miner malware or is being used for crypto mining.\n","references":["https://www.poolwatch.io/coin/monero","https://github.com/stamparm/maltrail/blob/da082537e0f37b9dece3a6998583e43bb5709c4e/trails/static/suspicious/crypto_mining.txt","https://www.virustotal.com/gui/search/behaviour_network%253A*.miningocean.org/files"],"logsource":{"product":"windows","category":"network_connection"},"tags":["attack.impact","attack.t1496"],"path":"rules/windows/network_connection/net_connection_win_domain_crypto_mining_pools.yml","techniques":["T1496"],"cves":[]}],"kev_cves":[{"cveID":"CVE-2025-4632","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2024-23692","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2023-22527","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2023-49897","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2023-47565","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2023-32315","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2023-38035","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2022-29303","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2023-1389","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2022-29464","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2021-35394","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2021-44228","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2018-11776","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2021-26084","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2017-9822","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2020-8515","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2018-7600","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2021-22205","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2019-18935","state":"mapped","mapping_types":["primary_impact"]}],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}