Techniques › T1496 › T1496.001

T1496.001 Compute Hijacking

impact — Windows, IaaS, Linux, macOS, Containers · attack.mitre.org · JSON

KEV CVEs mapped to this technique · CTID Mappings Explorer

None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.

Detection strategy · ATT&CK Enterprise v19.2

• DET0540 Multi-Platform Behavioral Detection for Compute Hijacking v1.0
  AN1489 Windows

  Sustained execution of resource-intensive processes (e.g., cryptocurrency miners), often launched via scheduled tasks, WMI, or PowerShell. These processes frequently establish persistent external connections and attempt to evade detection using masqueraded or renamed binaries.

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation

  WinEventLog:Security EventCode=4698 → DC0001 Scheduled Job Creation

  Tunable: Image DestinationIP ParentProcessName
  AN1490 Linux

  Unusual long-running processes consuming high CPU cycles (e.g., via 'top' or 'ps') initiated via cron, shell scripts, or Docker. Connections to known mining pools or DNS over HTTPS usage as evasion.

  auditd:SYSCALL execve → DC0032 Process Creation

  NSM:Flow Outbound connection to mining pool port (3333, 4444, 5555) → DC0078 Network Traffic Flow

  linux:cron Scheduled execution of unknown or unusual script/binary → DC0001 Scheduled Job Creation

  Tunable: CommandLine CPUThreshold
  AN1491 macOS

  Persistent or background daemons (e.g., plist or launchd jobs) spawning high-CPU processes like xmrig or cpuminer. Outbound encrypted traffic to IPs/domains commonly used by mining proxies.

  macos:unifiedlog launchd or cron spawning mining binaries → DC0032 Process Creation

  macos:unifiedlog Persistent outbound connections with consistent periodicity → DC0085 Network Traffic Content

  Tunable: launchd.plist_label DestinationDomain
  AN1492 Containers

  Ephemeral or unauthorized container instantiation using public images (e.g., from DockerHub) that initiate high CPU usage shortly after startup. Often scheduled via Kubernetes or Docker socket abuse.

  containerd:events create → DC0072 Container Creation

  auditd:SYSCALL execve → DC0032 Process Creation

  NSM:Flow Outbound traffic to mining pool upon container launch → DC0078 Network Traffic Flow

  Tunable: ImageSource Namespace
  AN1493 IaaS

  Unauthorized instance creation in unmonitored or unused regions. Burst of compute-intensive jobs in spot instances or sudden spike in resource usage in legitimate VMs.

  AWS:CloudTrail RunInstances → DC0080 Instance Start

  AWS:CloudWatch Unusual CPU burst or metric anomalies → DC0018 Host Status

  Tunable: Region TagKey

Sigma rules · SigmaHQ da9bb07d64, tag attack.t1496.001

Rules tagged at the parent level (attack.t1496) 13

These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.