Techniques › T1496 › T1496.002

T1496.002 Bandwidth Hijacking

impact — Linux, Windows, macOS, IaaS, Containers · attack.mitre.org · JSON

KEV CVEs mapped to this technique · CTID Mappings Explorer

None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.

Detection strategy · ATT&CK Enterprise v19.2

• DET0028 Detect Excessive or Unauthorized Bandwidth Usage for Botnet, Proxyjacking, or Scanning Purposes v1.0
  AN0080 Windows

  Processes invoking network-intensive child processes or uploading large data volumes, often from non-standard user or system contexts, with evidence of long-duration TCP/UDP sessions to unusual destinations.

  WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  Tunable: TimeWindow DestinationCountry ProcessName
  AN0081 Linux

  User-initiated processes generating sustained outbound traffic over common or non-standard ports, often outside business hours, potentially linked to scanning or proxyjacking. Includes curl, wget, masscan, or proxy clients.

  auditd:SYSCALL execve calls with high-frequency or known bandwidth-intensive tools → DC0032 Process Creation

  NSM:Flow large outbound data flows or long-duration connections → DC0078 Network Traffic Flow

  Tunable: ToolPattern TrafficRateThreshold
  AN0082 macOS

  Suspicious long-lived or high-throughput connections by non-Apple signed apps or processes not commonly associated with network uploads. Detect background processes using open sockets for data egress.

  macos:unifiedlog process + network metrics correlation for bandwidth saturation → DC0085 Network Traffic Content

  macos:unifiedlog exec or spawn calls to proxy tools or torrent clients → DC0032 Process Creation

  Tunable: ProcessSignedStatus DataRateThreshold
  AN0083 Containers

  Containerized apps or sidecar containers generating excessive outbound traffic or being leveraged for proxy networks. Includes sudden increases in network interface stats, especially in dormant or low-util apps.

  containers:osquery bandwidth-intensive command execution from within a container namespace → DC0032 Process Creation

  docker:stats unusual network TX/RX byte deltas → DC0085 Network Traffic Content

  Tunable: ContainerBaselineNetworkUsage ImageName
  AN0084 IaaS

  Virtual instances or workloads generating sustained outbound data rates, often to TOR, VPN, or proxy endpoints. Often coincides with unusual IAM usage or deployed scripts (e.g., cron jobs using proxy clients).

  AWS:CloudTrail StartInstances → DC0080 Instance Start

  AWS:VPCFlowLogs egress > 90th percentile or frequent connection reuse → DC0078 Network Traffic Flow

  Tunable: InstanceType TrafficEgressThreshold

Sigma rules · SigmaHQ da9bb07d64, tag attack.t1496.002

Rules tagged at the parent level (attack.t1496) 13

These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.