Resource Hijacking T1496

Tactic: Impact

Adversaries may leverage the resources of co-opted systems to complete resource-intensive tasks, which may impact system and/or hosted service availability.

Events covered

7 catalog events are tagged with this technique by at least one rule.

Authoring guide

These 62 rules share fields, values, and exclusions.

Fields filtered most (81 distinct)

These fields appear most often in rule filters.

FieldRulesHowSample values
EventType17eq 12, in 4, starts_with 1exec, start, Invoke, ProcessRollup2, connection_attempted
process_name9eq 3, in 3, wildcard 3, is_not_null 1, starts_with 1bash, .*, ash, csh, dash
event.type8eq 8start, creation
operationName7eq 7microsoft.containerregistry/registries/delete, microsoft.containerregistry/registries/write, microsoft.kubernetes/connectedclusters/configmaps/delete, microsoft.kubernetes/connectedclusters/configmaps/write, microsoft.kubernetes/connectedclusters/delete
CommandLine6contains 6 --algo=rx/0 , --cpu-priority=, --nicehash, dero , --algo
EventID6eq 5, regex_match 14688, 1, 4104, CreateEmailIdentity, CryptoCurrency|CryptoMinerExecuted|BitcoinDomainRequest
Image6wildcard 3, starts_with 2, contains 1./, /boot/, /dev/shm/, ./*, /boot/*
Provider_Name6eq 6sns.amazonaws.com, bedrock.amazonaws.com, ecs.amazonaws.com, lambda.amazonaws.com
data_stream.dataset5eq 5aws.cloudtrail, network_traffic.redis
event.outcome5eq 5success
OperationName4eq 4, contains 1Library.ServiceConnectionExecuted, HasExactBlocklist, backupitem, hasanyblocklist
azure_ad::operation_name_value4in 2, contains 1, eq 1microsoft.compute/virtualmachines/write, microsoft.resources/deployments/write, microsoft.resources/subscriptions/resourcegroups/write, microsoft.subscription/updatetenant/action, write
process.args4eq 4, contains 1, in 1-c, --algo, --coin, --hash, --write
ParentImage3is_not_null 3
QueryName3ends_with 2, eq 10xrpc.io, 1rpc.io, 2miners.com, 2miners.org, 4i7i.com

Top indicator values (1657 distinct)

These values appear most often in rule predicates.

FieldKindValueRules (here)Corpus reach
event.typeeq
start
71078
EventTypeeq
exec
5576
event.outcomeeq
success
5369
CommandLinecontains
stratum+tcp://
44
CommandLinecontains
--algo=rx/0
22
CommandLinecontains
--cpu-priority=
22
CommandLinecontains
--nicehash
22
CommandLinecontains
-o pool.
22
CommandLinecontains
--donate-level=0
22
CommandLinecontains
0tzg9uyxrllwxldmvsp
22
CommandLinecontains
c3ryyxr1bst0y3a6ly
22
CommandLinecontains
c3ryyxr1bst1zha6ly
22
CommandLinecontains
ls1kb25hdgutbgv2zww9
22
CommandLinecontains
n0cmf0dw0rdgnwoi8v
22
CommandLinecontains
n0cmf0dw0rdwrwoi8v
22
CommandLinecontains
stratum+udp://
22
CommandLinecontains
stratum2+tcp://
22
CommandLinecontains
tlwrvbmf0zs1szxzlbd
22
CommandLinecontains
zdhjhdhvtk3rjcdovl
22
CommandLinecontains
zdhjhdhvtk3vkcdovl
22
data_stream.dataseteq
aws.cloudtrail
4169
Provider_Nameeq
sns.amazonaws.com
33
process_namein
bash
3202
process_namein
csh
3159
process_namein
dash
3170
process_namein
fish
3163
process_namein
ksh
3163
process_namein
sh
3197
process_namein
tcsh
3156
process_namein
zsh
3196

Exclusions (108 distinct)

These values appear most often in top-level exclusions.

FieldKindValueRules excluding
CommandLineregex_match
(?i)(pool\.(c|o))\s|gcc\s-
3
ActorUPNeq
AllowlistedUpns
1
CommandLinecontains
pool.c
1
CommandLinecontains
pool.o
1
CommandLinecontains
/var/tools/koalaping/bin/ping.php
1
CommandLinecontains
app/jobs/ant-sec_observe-income.py
1
CommandLinecontains
gcc -
1
CommandLinecontains
zpool.cache
1
CommandLinewildcard
*--display-charset*
1
CommandLinewildcard
*openssl*
1
CommandLinewildcard
python3 /root/nicehash/nicehash.py -b https://api2.nicehash.com -o * -m GET...
1
CommandLinewildcard
sh -c aws s3 cp*
1
DriftInformation.StackDriftStatusne
DRIFTED
1
EnableTerminationProtectioneq
true
1
Imageeq
/usr/bin/grep
1

Rules under this technique

These vendors publish rules tagged with this technique.

Platform (all)
Domain (all)

Sigma 13 rules

Elastic 18 rules

Splunk 3 rules

Kusto 19 rules

YARA-L 2 rules

Panther 7 rules