Cross-source coverage
T1496.001 / ATT&CK
Resource Hijacking: Compute Hijacking
2 rules across 1 source.
From MITRE ATT&CK 19.2
Adversaries may leverage the compute resources of co-opted systems to complete resource-intensive tasks, which may impact system and/or hosted service availability.
One common purpose for Compute Hijacking is to validate transactions of cryptocurrency networks and earn virtual currency. Adversaries may consume enough system resources to negatively impact and/or cause affected machines to become unresponsive. Servers and cloud-based systems are common targets because of the high potential for available resources, but user endpoint systems may also be compromised and used for Compute Hijacking and cryptocurrency mining. Containerized environments may also be targeted due to the ease of deployment via exposed APIs and the potential for scaling mining activities by deploying or compromising multiple containers within an environment or cluster.
Additionally, some cryptocurrency mining malware identify then kill off processes for competing malware to ensure it’s not competing for resources.
- Tactics
- Impact
- Platforms
- Windows · IaaS · Linux · macOS · Containers
- Telemetry
-
WinEventLog:SysmonWinEventLog:Securityauditd:SYSCALLNSM:Flowlinux:cronmacos:unifiedlogcontainerd:eventsAWS:CloudTrailAWS:CloudWatch
How MITRE says to detect it DET0540
Multi-Platform Behavioral Detection for Compute Hijacking
Windows Analytic 1489
Sustained execution of resource-intensive processes (e.g., cryptocurrency miners), often launched via scheduled tasks, WMI, or PowerShell. These processes frequently establish persistent external connections and attempt to evade detection using masqueraded or renamed binaries.
WinEventLog:SysmonEventCode=1WinEventLog:SysmonEventCode=3, 22WinEventLog:SecurityEventCode=4698
Linux Analytic 1490
Unusual long-running processes consuming high CPU cycles (e.g., via 'top' or 'ps') initiated via cron, shell scripts, or Docker. Connections to known mining pools or DNS over HTTPS usage as evasion.
auditd:SYSCALLexecveNSM:FlowOutbound connection to mining pool port (3333, 4444, 5555)linux:cronScheduled execution of unknown or unusual script/binary
macOS Analytic 1491
Persistent or background daemons (e.g., plist or launchd jobs) spawning high-CPU processes like xmrig or cpuminer. Outbound encrypted traffic to IPs/domains commonly used by mining proxies.
macos:unifiedloglaunchd or cron spawning mining binariesmacos:unifiedlogPersistent outbound connections with consistent periodicity
Containers Analytic 1492
Ephemeral or unauthorized container instantiation using public images (e.g., from DockerHub) that initiate high CPU usage shortly after startup. Often scheduled via Kubernetes or Docker socket abuse.
containerd:eventscreateauditd:SYSCALLexecveNSM:FlowOutbound traffic to mining pool upon container launch
IaaS Analytic 1493
Unauthorized instance creation in unmonitored or unused regions. Burst of compute-intensive jobs in spot instances or sudden spike in resource usage in legitimate VMs.
AWS:CloudTrailRunInstancesAWS:CloudWatchUnusual CPU burst or metric anomalies
elastic/detection-rules
2 rules| Detection | Severity | Format |
|---|---|---|
| Newly Observed Process Exhibiting High CPU Usage | High | Elastic TOML |
| Memory Swap Modification | Medium | Elastic TOML |