T1496 — Resource Hijacking

Technique

T1496

Tactics

Impact

MISP citations

0

KEV CVEs mapped

19

Community rules

13

thrunt rules

0

Upstream

https://attack.mitre.org/techniques/T1496

MITRE description

Adversaries may leverage the resources of co-opted systems to complete resource-intensive tasks, which may impact system and/or hosted service availability. Resource hijacking may take a number of different forms. For example, adversaries may: * Leverage compute resources in order to mine cryptocurrency * Sell network bandwidth to proxy networks * Generate SMS traffic for profit * Abuse cloud-based messaging services to send large quantities of spam messages In some cases, adversaries may leverage multiple types of Resource Hijacking at once.(Citation: Sysdig Cryptojacking Proxyjacking 2023)

KEV CVEs mapped to this technique

Per MITRE CTID's hand-curated KEV→ATT&CK mappings — these are the actively-exploited vulnerabilities behind this technique's KEV signal.

• CVE-2025-4632
• CVE-2024-23692
• CVE-2023-49897
• CVE-2023-47565
• CVE-2023-38035
• CVE-2023-32315
• CVE-2023-22527
• CVE-2023-1389
• CVE-2022-29464
• CVE-2022-29303
• CVE-2021-44228
• CVE-2021-35394
• CVE-2021-26084
• CVE-2021-22205
• CVE-2020-8515
• CVE-2019-18935
• CVE-2018-7600
• CVE-2018-11776
• CVE-2017-9822

Detection coverage

SigmaHQ community rules

• Azure Container Registry Created or Deleted (core)
• Azure Kubernetes Cluster Created or Deleted (core)
• Azure Kubernetes Network Policy Change (core)
• Azure Kubernetes Sensitive Role Access (core)
• Azure Kubernetes RoleBinding/ClusterRoleBinding Modified and Deleted (core)
• Azure Kubernetes Secret or Config Object Access (core)
• Azure Kubernetes Service Account Modified or Deleted (core)
• Linux Crypto Mining Pool Connections (core)
• Linux Crypto Mining Indicators (core)
• Monero Crypto Coin Mining Pool Lookup (core)
• DNS Events Related To Mining Pools (core)
• Network Communication With Crypto Mining Pool (core)
• Potential Crypto Mining Activity (core)

Signal counts reflect the current corpus snapshot: MISP citations are regex-extracted from CIRCL OSINT event text and galaxy tags; KEV mappings come from MITRE CTID; community coverage is the SigmaHQ rule inventory (core, emerging-threats, threat-hunting collections) at release r2026-04-01. Rule bodies are not mirrored — links go upstream.