Resource Hijacking (T1496)

Tactic: Impact · Platforms: Windows, IaaS, Linux, macOS, Containers, SaaS

The interactive view maps 1 detection strategy to this technique, alongside D3FEND countermeasures and data-component coverage.

Overview

Adversaries may leverage the resources of co-opted systems to complete resource-intensive tasks, which may impact system and/or hosted service availability.

Resource hijacking may take a number of different forms. For example, adversaries may:

* Leverage compute resources in order to mine cryptocurrency * Sell network bandwidth to proxy networks * Generate SMS traffic for profit * Abuse cloud-based messaging services to send large quantities of spam messages

In some cases, adversaries may leverage multiple types of Resource Hijacking at once.

Sub-techniques

• Compute Hijacking (T1496.001)
• Bandwidth Hijacking (T1496.002)
• SMS Pumping (T1496.003)
• Cloud Service Hijacking (T1496.004)

Explore

• Open T1496 in the interactive ATT&CK matrix
• ATT&CK Intelligence View guide
• Official MITRE ATT&CK entry for T1496
• Sigma detection rules for MITRE ATT&CK
• Built by Shahrukh Khan