| name | T1496_resource-hijacking |
| description | Adversaries may leverage the resources of co-opted systems to complete resource-intensive tasks, which may impact system and/or hosted service availability. |
| category | business-logic |
| version | 18.1 |
| author | cyberstrike-official |
| tags | ["mitre-attack","enterprise","t1496","impact","windows","iaas","linux","macos","containers","saas"] |
| technique_id | T1496 |
| tactic | impact |
| all_tactics | ["impact"] |
| platforms | ["Windows","IaaS","Linux","macOS","Containers","SaaS"] |
| mitre_url | https://attack.mitre.org/techniques/T1496 |
| tech_stack | ["windows","cloud","linux","macos","containers","saas"] |
| cwe_ids | ["CWE-400"] |
| chains_with | ["T1496.001","T1496.002","T1496.003","T1496.004"] |
| prerequisites | [] |
| severity_boost | {"T1496.001":"Chain with T1496.001 for deeper attack path","T1496.002":"Chain with T1496.002 for deeper attack path","T1496.003":"Chain with T1496.003 for deeper attack path"} |
T1496 Resource Hijacking
High-Level Description
Adversaries may leverage the resources of co-opted systems to complete resource-intensive tasks, which may impact system and/or hosted service availability.
Resource hijacking may take a number of different forms. For example, adversaries may:
- Leverage compute resources in order to mine cryptocurrency
- Sell network bandwidth to proxy networks
- Generate SMS traffic for profit
- Abuse cloud-based messaging services to send large quantities of spam messages
In some cases, adversaries may leverage multiple types of Resource Hijacking at once.
Kill Chain Phase
Platforms: Windows, IaaS, Linux, macOS, Containers, SaaS
What to Check
How to Test
Atomic Red Team Tests
The following tests are from Atomic Red Team and provide actionable ways to test this technique:
Atomic Test 1: FreeBSD/macOS/Linux - Simulate CPU Load with Yes
This test simulates a high CPU load as you might observe during cryptojacking attacks.
End the test by using CTRL/CMD+C to break.
Supported Platforms: linux, macos
yes > /dev/null
Atomic Test 2: Windows - Simulate CPU Load with PowerShell
This test simulates high CPU load using PowerShell, commonly seen in resource hijacking.
Spawns background jobs to stress CPU cores for a specified duration.
Supported Platforms: windows
$end = (Get-Date).AddSeconds(#{duration_seconds})
1..#{cpu_threads} | ForEach-Object { Start-Job { param($t) while((Get-Date) -lt $t) { $i=0; while($i -lt 200000){$i++} } } -ArgumentList $end }
Get-Job | Wait-Job | Remove-Job
Manual Testing
If Atomic Red Team tests are not applicable, manually verify the technique by:
