{"id":"T1496.003","name":"SMS Pumping","url":"https://attack.mitre.org/techniques/T1496/003","tactics":["impact"],"platforms":["SaaS"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0156","stix_id":"x-mitre-detection-strategy--9c36b7a8-22bb-4420-a8ac-8e46ddef5674","name":"Detection Strategy for Resource Hijacking: SMS Pumping via SaaS Application Logs","url":"https://attack.mitre.org/detectionstrategies/DET0156","analytics":[{"id":"AN0443","stix_id":"x-mitre-analytic--5beb62fd-7dac-485f-828c-72cf151124a8","name":"Analytic 0443","description":"Automated and repetitive triggering of SMS messages through OTP/account verification fields on SaaS platforms, leveraging background messaging APIs such as Twilio, AWS SNS, or Amazon Cognito to generate traffic toward attacker-controlled numbers.","url":"https://attack.mitre.org/detectionstrategies/DET0156#AN0443","platforms":["SaaS"],"log_source_references":[{"name":"saas:application","channel":"High-frequency invocation of SMS-related API endpoints from publicly accessible OTP or verification forms (e.g., Twilio: SendMessage, Cognito: AdminCreateUser) with irregular destination patterns.","data_component":"DC0038","data_component_name":"Application Log Content","log_source_slug":"saas-application"},{"name":"saas:audit","channel":"Repeated requests to SMS-generating endpoints using anomalous or new user agents, IP ranges, or geographies.","data_component":"DC0002","data_component_name":"User Account Authentication","log_source_slug":"saas-audit"}],"mutable_elements":[{"field":"TimeWindow","description":"Defines the rolling window over which SMS API invocation frequency is measured. Tunable based on average platform traffic."},{"field":"SMSFrequencyThreshold","description":"Number of SMS requests per endpoint or per user that should trigger investigation. Should align with business logic and user behavior."},{"field":"DestinationCountryCodeFilter","description":"Monitors if requests target known high-risk, revenue-sharing regions. Tunable to reflect SMS tariff rates or abuse history."},{"field":"UserAgentAnomalyThreshold","description":"Defines outlier score or list of unknown/automated user agents submitting forms."},{"field":"IPGeoVarianceScore","description":"Tracks abnormal geographic spread of traffic sourcing OTP triggers."}],"live":true,"detection_strategies":["DET0156"],"techniques":["T1496.003"]}],"live":true,"version":"1.0","techniques":["T1496.003"]}],"sigma_rules":[],"kev_cves":[],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}