Techniques › T1496 › T1496.004
T1496.004 Cloud Service Hijacking
impact — SaaS · attack.mitre.org · JSON
1
MITRE detection strategy
1
analytics
0
Sigma rules tagged attack.t1496.004
0
KEV CVEs mapped here
<p>Adversaries may leverage compromised software-as-a-service (SaaS) applications to complete resource-intensive tasks, which may impact hosted service availability.</p><p>For example, adversaries may leverage email and messaging services, such as AWS Simple Email Service (SES), AWS Simple Notification Service (SNS), SendGrid, and Twilio, in order to send large quantities of spam / Phishing emails and SMS messages. Alternatively, they may engage in LLMJacking by leveraging reverse proxies to hijack the power of cloud-hosted AI models.</p><p>In some cases, adversaries may leverage services that the victim is already using. In others, particularly when the service is part of a larger cloud platform, they may first enable the service. Leveraging SaaS applications may cause the victim to incur significant financial costs, use up service quotas, and otherwise impact availability.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0147 Detection Strategy for Cloud Service Hijacking via SaaS Abuse v1.0
AN0417 SaaSAdversary gains access to cloud-hosted services such as AWS SES, SNS, or OpenAI API, enables or modifies usage policies, and initiates resource-intensive actions (e.g., mass email/SMS or LLM queries), often from unauthorized regions or under anomalous identity conditions.Tunable:
TimeWindowUserContextRequestVolumeThresholdGeoVelocityThresholdModelUsageQuotaSpike
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1496.004
No Sigma rule carries this tag. MITRE publishes a detection strategy above, so the behaviour is specified; what is missing is public detection content.
Rules tagged at the parent level (attack.t1496) 13
These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.
Author: Austin Songer @austinsonger
· 2021-08-07 (modified 2022-08-23) · logsource: product=azure service=activitylogs · 08d6ac24-c927-4469-b3b7-2e422d6e3c43
Identifies when a Azure Kubernetes network policy is modified or deleted.
Author: Austin Songer @austinsonger
· 2021-08-07 (modified 2022-08-23) · logsource: product=azure service=activitylogs · 12d027c3-b48c-4d9d-8bb6-a732200034b2
Identifies when a service account is modified or deleted.
Author: Austin Songer @austinsonger
· 2021-08-07 (modified 2022-08-23) · logsource: product=azure service=activitylogs · 25cb259b-bbdc-4b87-98b7-90d7c72f8743
Detects the creation or patching of potential malicious RoleBinding/ClusterRoleBinding.
Author: Florian Roth (Nextron Systems)
· 2021-10-26 (modified 2023-02-13) · logsource: product=windows category=process_creation · 66c3b204-9f88-4d0a-a7f7-8a57d521ca55
Detects command line parameters or strings often used by crypto miners
Author: Austin Songer @austinsonger
· 2021-08-07 (modified 2022-08-23) · logsource: product=azure service=activitylogs · 7ee0b4aa-d8d4-4088-b661-20efdf41a04c
Identifies when a Kubernetes account access a sensitive objects such as configmaps or secrets.
Author: Austin Songer @austinsonger
· 2021-08-07 (modified 2022-08-23) · logsource: product=azure service=activitylogs · 818fee0c-e0ec-4e45-824e-83e4817b0887
Identifies when ClusterRoles/Roles are being modified or deleted.
Author: Florian Roth (Nextron Systems)
· 2021-10-26 (modified 2022-12-25) · logsource: product=linux category=process_creation · 9069ea3c-b213-4c52-be13-86506a227ab1
Detects command line parameters or strings often used by crypto miners
Author: Austin Songer @austinsonger
· 2021-08-07 (modified 2022-08-23) · logsource: product=azure service=activitylogs · 93e0ef48-37c8-49ed-a02c-038aab23628e
Detects when a Container Registry is created or deleted.
Author: Austin Songer @austinsonger
· 2021-08-07 (modified 2022-08-23) · logsource: product=azure service=activitylogs · 9541f321-7cba-4b43-80fc-fbd1fb922808
Detects when a Azure Kubernetes Cluster is created or deleted.
Author: Florian Roth (Nextron Systems)
· 2021-10-26 · logsource: product=linux category=network_connection · a46c93b7-55ed-4d27-a41b-c259456c4746
Detects process connections to a Monero crypto mining pool
Author: Florian Roth (Nextron Systems)
· 2021-10-24 · logsource: category=dns · b593fd50-7335-4682-a36c-4edcb68e4641
Detects suspicious DNS queries to Monero mining pools
Author: Saw Winn Naung, Azure-Sentinel, @neu5ron
· 2021-08-19 (modified 2022-07-07) · logsource: product=zeek service=dns · bf74135c-18e8-4a72-a926-0e4f47888c19
Identifies clients that may be performing DNS lookups associated with common currency mining pools.
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
· 2021-10-26 (modified 2026-07-24) · logsource: product=windows category=network_connection · fa5b1358-b040-4403-9868-15f7d9ab6329
Detects initiated network connections to crypto mining pools.
It indicates that the system is likely infected with a crypto miner malware or is being used for crypto mining.