T1496 Resource Hijacking

Technique

T1496

Tactics

Impact

Research, 90 days

1

KEV CVEs mapped

19

SigmaHQ rules

13

Elastic, Splunk

15

thrunt rules

0

Active families

XMRig

Upstream

https://attack.mitre.org/techniques/T1496

MITRE description

Adversaries may leverage the resources of co-opted systems to complete resource-intensive tasks, which may impact system and/or hosted service availability. Resource hijacking may take a number of different forms. For example, adversaries may: * Leverage compute resources in order to mine cryptocurrency * Sell network bandwidth to proxy networks * Generate SMS traffic for profit * Abuse cloud-based messaging services to send large quantities of spam messages In some cases, adversaries may leverage multiple types of Resource Hijacking at once.(Citation: Sysdig Cryptojacking Proxyjacking 2023)

KEV CVEs mapped to this technique

MITRE CTID maps these KEV CVEs to this technique by hand. They are the actively exploited vulnerabilities behind this technique's KEV signal.

• CVE-2025-4632
• CVE-2024-23692
• CVE-2023-49897
• CVE-2023-47565
• CVE-2023-38035
• CVE-2023-32315
• CVE-2023-22527
• CVE-2023-1389
• CVE-2022-29464
• CVE-2022-29303
• CVE-2021-44228
• CVE-2021-35394
• CVE-2021-26084
• CVE-2021-22205
• CVE-2020-8515
• CVE-2019-18935
• CVE-2018-7600
• CVE-2018-11776
• CVE-2017-9822

Research citing this technique

Reports and advisories from the last 90 days that cite this technique.

• 2026-11-03 Microsoft Threat Intelligence: Fake-download campaign uses trojanized installers to deliver monetization payloads

Detection coverage

SigmaHQ community rules

• Azure Container Registry Created or Deleted (core)
• Azure Kubernetes Cluster Created or Deleted (core)
• Azure Kubernetes Network Policy Change (core)
• Azure Kubernetes Sensitive Role Access (core)
• Azure Kubernetes RoleBinding/ClusterRoleBinding Modified and Deleted (core)
• Azure Kubernetes Secret or Config Object Access (core)
• Azure Kubernetes Service Account Modified or Deleted (core)
• Linux Crypto Mining Pool Connections (core)
• Linux Crypto Mining Indicators (core)
• Monero Crypto Coin Mining Pool Lookup (core)
• DNS Events Related To Mining Pools (core)
• Network Communication With Crypto Mining Pool (core)
• Potential Crypto Mining Activity (core)

Elastic and Splunk rules

• Newly Observed Process Exhibiting High CPU Usage (elastic)
• Anthropic Excessive Chat Creation (elastic)
• Anthropic Extra Usage Spend Limit Deleted (elastic)
• AWS SNS Rare Protocol Subscription by User (elastic)
• AWS Bedrock Provisioned Model Throughput Tampering (elastic)
• AWS Potential Cryptomining via ECS Task Definition Deployment (elastic)
• AWS Lambda Function High-Frequency Invocation by a Single Principal (elastic)
• AWS SNS Topic Message Publish by Rare User (elastic)
• AWS SNS Topic Created by Rare User (elastic)
• Microsoft Foundry High Request and Token Volume (elastic)
• GCP Vertex AI High Request and Token Volume (elastic)
• Suspicious Mining Process Creation Event (elastic)
• Memory Swap Modification (elastic)
• Potential Malware-Driven SSH Brute Force Attempt (elastic)
• Potential Redis CONFIG SET Cron Directory Persistence (RedisRaider) (elastic)

Signal counts reflect the current corpus snapshot. Research citations are the technique IDs named in vendor reports and government advisories from the last 90 days; KEV mappings come from MITRE CTID. Coverage is the SigmaHQ rule inventory (core, emerging-threats, threat-hunting) at release r2026-07-01 plus Elastic and Splunk production rules. Rule bodies are not mirrored; links go upstream.