TA0040 · IMPACT
Resource Hijacking
Adversaries may leverage the resources of co-opted systems to complete resource-intensive tasks, which may impact system and/or hosted service availability. Resource hijacking may take a number of different forms.
Detect it with
Consider monitoring process resource usage to determine anomalous activity associated with malicious hijacking of computer resources such as CPU, memory, and graphics processing resources.
Why it matters on shift
Resource Hijacking is one of the concrete ways adversaries achieve impact. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After impact, the next tactic is usually Impact. Search your telemetry for the transition before closing the ticket.
4 sub-techniques
How it shows up in practice
- T1496.001
Compute Hijacking
Adversaries may leverage the compute resources of co-opted systems to complete resource-intensive tasks, which may impact system and/or hosted service availability.
- T1496.002
Bandwidth Hijacking
Adversaries may leverage the network bandwidth resources of co-opted systems to complete resource-intensive tasks, which may impact system and/or hosted service availability.
- T1496.003
SMS Pumping
Adversaries may leverage messaging services for SMS pumping, which may impact system and/or hosted service availability.
- T1496.004
Cloud Service Hijacking
Adversaries may leverage compromised software-as-a-service (SaaS) applications to complete resource-intensive tasks, which may impact hosted service availability.
Kill-chain context