Techniques › T1496 › T1496.003
T1496.003 SMS Pumping
impact — SaaS · attack.mitre.org · JSON
1
MITRE detection strategy
1
analytics
0
Sigma rules tagged attack.t1496.003
0
KEV CVEs mapped here
<p>Adversaries may leverage messaging services for SMS pumping, which may impact system and/or hosted service availability. SMS pumping is a type of telecommunications fraud whereby a threat actor first obtains a set of phone numbers from a telecommunications provider, then leverages a victim’s messaging infrastructure to send large amounts of SMS messages to numbers in that set. By generating SMS traffic to their phone number set, a threat actor may earn payments from the telecommunications provider.</p><p>Threat actors often use publicly available web forms, such as one-time password (OTP) or account verification fields, in order to generate SMS traffic. These fields may leverage services such as Twilio, AWS SNS, and Amazon Cognito in the background. In response to the large quantity of requests, SMS costs may increase and communication channels may become overwhelmed.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0156 Detection Strategy for Resource Hijacking: SMS Pumping via SaaS Application Logs v1.0
AN0443 SaaSAutomated and repetitive triggering of SMS messages through OTP/account verification fields on SaaS platforms, leveraging background messaging APIs such as Twilio, AWS SNS, or Amazon Cognito to generate traffic toward attacker-controlled numbers.saas:application
High-frequency invocation of SMS-related API endpoints from publicly accessible OTP or verification forms (e.g., Twilio: SendMessage, Cognito: AdminCreateUser) with irregular destination patterns.→ DC0038 Application Log Contentsaas:auditRepeated requests to SMS-generating endpoints using anomalous or new user agents, IP ranges, or geographies.→ DC0002 User Account AuthenticationTunable:TimeWindowSMSFrequencyThresholdDestinationCountryCodeFilterUserAgentAnomalyThresholdIPGeoVarianceScore
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1496.003
No Sigma rule carries this tag. MITRE publishes a detection strategy above, so the behaviour is specified; what is missing is public detection content.
Rules tagged at the parent level (attack.t1496) 13
These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.
Author: Austin Songer @austinsonger
· 2021-08-07 (modified 2022-08-23) · logsource: product=azure service=activitylogs · 08d6ac24-c927-4469-b3b7-2e422d6e3c43
Identifies when a Azure Kubernetes network policy is modified or deleted.
Author: Austin Songer @austinsonger
· 2021-08-07 (modified 2022-08-23) · logsource: product=azure service=activitylogs · 12d027c3-b48c-4d9d-8bb6-a732200034b2
Identifies when a service account is modified or deleted.
Author: Austin Songer @austinsonger
· 2021-08-07 (modified 2022-08-23) · logsource: product=azure service=activitylogs · 25cb259b-bbdc-4b87-98b7-90d7c72f8743
Detects the creation or patching of potential malicious RoleBinding/ClusterRoleBinding.
Author: Florian Roth (Nextron Systems)
· 2021-10-26 (modified 2023-02-13) · logsource: product=windows category=process_creation · 66c3b204-9f88-4d0a-a7f7-8a57d521ca55
Detects command line parameters or strings often used by crypto miners
Author: Austin Songer @austinsonger
· 2021-08-07 (modified 2022-08-23) · logsource: product=azure service=activitylogs · 7ee0b4aa-d8d4-4088-b661-20efdf41a04c
Identifies when a Kubernetes account access a sensitive objects such as configmaps or secrets.
Author: Austin Songer @austinsonger
· 2021-08-07 (modified 2022-08-23) · logsource: product=azure service=activitylogs · 818fee0c-e0ec-4e45-824e-83e4817b0887
Identifies when ClusterRoles/Roles are being modified or deleted.
Author: Florian Roth (Nextron Systems)
· 2021-10-26 (modified 2022-12-25) · logsource: product=linux category=process_creation · 9069ea3c-b213-4c52-be13-86506a227ab1
Detects command line parameters or strings often used by crypto miners
Author: Austin Songer @austinsonger
· 2021-08-07 (modified 2022-08-23) · logsource: product=azure service=activitylogs · 93e0ef48-37c8-49ed-a02c-038aab23628e
Detects when a Container Registry is created or deleted.
Author: Austin Songer @austinsonger
· 2021-08-07 (modified 2022-08-23) · logsource: product=azure service=activitylogs · 9541f321-7cba-4b43-80fc-fbd1fb922808
Detects when a Azure Kubernetes Cluster is created or deleted.
Author: Florian Roth (Nextron Systems)
· 2021-10-26 · logsource: product=linux category=network_connection · a46c93b7-55ed-4d27-a41b-c259456c4746
Detects process connections to a Monero crypto mining pool
Author: Florian Roth (Nextron Systems)
· 2021-10-24 · logsource: category=dns · b593fd50-7335-4682-a36c-4edcb68e4641
Detects suspicious DNS queries to Monero mining pools
Author: Saw Winn Naung, Azure-Sentinel, @neu5ron
· 2021-08-19 (modified 2022-07-07) · logsource: product=zeek service=dns · bf74135c-18e8-4a72-a926-0e4f47888c19
Identifies clients that may be performing DNS lookups associated with common currency mining pools.
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
· 2021-10-26 (modified 2026-07-24) · logsource: product=windows category=network_connection · fa5b1358-b040-4403-9868-15f7d9ab6329
Detects initiated network connections to crypto mining pools.
It indicates that the system is likely infected with a crypto miner malware or is being used for crypto mining.