T1496.001 — Compute Hijacking

Tactic: Impact · Platforms: Windows, IaaS, Linux, macOS, Containers

Adversaries may leverage the compute resources of co-opted systems to complete resource-intensive tasks, which may impact system and/or hosted service availability. One common purpose for Compute Hijacking is to validate transactions of cryptocurrency networks and earn virtual currency.…

Sub-technique of Resource Hijacking (T1496).

Sigma detection rules (5)

title: "T1496.001 Resource Hijacking: Compute Hijacking"
id: f618b155-9bb0-4ff2-b9c1-a64891a84f6e
description: 'Multi-Platform Behavioral Detection for Compute Hijacking via outbound network connections to known cryptomining stratum/pool ports and hostnames. (Data Component: Network Connection Creation; baseline tier: windows-eventid.) Tune using: Image, DestinationIP, ParentProcessName.'
references:
  - https://attack.mitre.org/techniques/T1496/001
author: Shahrukh Khan
date: 2026-01-24
license: MIT
tags:
  - attack.impact
  - attack.t1496.001

logsource:
  category: network_connection
  product: windows
  service: sysmon

detection:
  selection_port:
    EventID: 3
    Initiated: 'true'
    DestinationPort:
      - 3333
      - 4444
      - 5555
      - 7777
      - 8080
      - 14444
      - 45700
  selection_hostname:
    EventID: 3
    Initiated: 'true'
    DestinationHostname|contains:
      - 'pool.'
      - 'xmr'
      - 'monero'
      - 'nanopool'
      - 'minexmr'
      - 'stratum+tcp'

  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: (selection_port or selection_hostname) and not filter_system_account

falsepositives:
  - Legitimate blockchain/crypto-related applications explicitly approved for business use; System and service accounts (SYSTEM, LOCAL SERVICE, NETWORK SERVICE) performing the same action are excluded via filter_system_account; tune further with process/path allowlists if noise remains.

level: medium

title: "T1496.001 Resource Hijacking: Compute Hijacking"
id: 95becb16-6953-4cfb-9298-55bd401fd3ae
description: 'Multi-Platform Behavioral Detection for Compute Hijacking. (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: CommandLine, CPUThreshold.'
references:
  - https://attack.mitre.org/techniques/T1496/001
author: Shahrukh Khan
date: 2026-03-23
license: MIT
tags:
  - attack.impact
  - attack.t1496.001

logsource:
  category: process_creation
  product: linux

detection:
  selection:
    type: EXECVE
    a0|endswith:
      - '/xmrig'
      - '/minerd'
    a1|contains:
      - 'pool'
      - 'stratum+tcp'

  condition: selection

falsepositives:
  - Legitimate, explicitly-provisioned mining hosts; CPUThreshold sustained-load correlation needs a resource monitor, not just this process-launch rule.

level: high

title: "T1496.001 Resource Hijacking: Compute Hijacking"
id: 5c4286f4-4817-4bc0-88ab-8213a1003ea9
description: 'Multi-Platform Behavioral Detection for Compute Hijacking. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: launchd.plist_label, DestinationDomain.'
references:
  - https://attack.mitre.org/techniques/T1496/001
author: Shahrukh Khan
date: 2026-02-24
license: MIT
tags:
  - attack.impact
  - attack.t1496.001

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    ParentImage|endswith: '/launchd'
    CommandLine|contains:
      - 'stratum+tcp'
      - 'xmrig'
      - '--cuda'
      - '--opencl'
  condition: selection

falsepositives:
  - A LaunchAgent or LaunchDaemon that starts a GPU or CPU intensive process is not inherently malicious, so this should be paired with plist label review to confirm it is not an approved rendering or scientific computing job.

level: high

title: "T1496.001 Resource Hijacking: Compute Hijacking"
id: 4b288ae0-002c-4e69-827a-ba45383d0d9f
description: 'Multi-Platform Behavioral Detection for Compute Hijacking. (Retargeted to the cloudtrail AWS telemetry that actually captures this techniques behavior; see logsource below.) Tune using: Region, TagKey.'
references:
  - https://attack.mitre.org/techniques/T1496/001
author: Shahrukh Khan
date: 2026-02-23
license: MIT
tags:
  - attack.impact
  - attack.t1496.001

logsource:
  category: cloudtrail
  product: aws

detection:
  selection:
    eventSource: 'ec2.amazonaws.com'
    eventName: 'RunInstances'
    requestParameters.instanceType|contains:
      - 'p3.'
      - 'p4d.'
      - 'g4dn.'
      - 'g5.'
      - 'inf1.'

  condition: selection

falsepositives:
  - Data science teams routinely launch GPU compute instances for legitimate training workloads, so require region/cost-center tagging review and unusual region as corroborating evidence.

level: high

title: "T1496.001 Resource Hijacking: Compute Hijacking"
id: d012d523-ffc3-4d86-8081-3e083e70e590
description: 'Multi-Platform Behavioral Detection for Compute Hijacking via container/orchestrator run commands referencing known miner tooling, checked across multiple argv positions rather than a fixed index, since docker/kubectl run invocations commonly interleave flags (-d, --name, --rm, etc.) before the image/command argument. (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ImageSource, Namespace.'
references:
  - https://attack.mitre.org/techniques/T1496/001
author: Shahrukh Khan
date: 2026-04-28
license: MIT
tags:
  - attack.impact
  - attack.t1496.001

logsource:
  category: process_creation
  product: linux
  service: auditd

detection:
  selection_run:
    type: EXECVE
    a0|endswith:
      - '/docker'
      - '/kubectl'
    a1|contains: 'run'
  selection_miner_args:
    - a2|contains:
        - 'xmrig'
        - 'miner'
    - a3|contains:
        - 'xmrig'
        - 'miner'
    - a4|contains:
        - 'xmrig'
        - 'miner'
    - a5|contains:
        - 'xmrig'
        - 'miner'
    - a6|contains:
        - 'xmrig'
        - 'miner'
    - a7|contains:
        - 'xmrig'
        - 'miner'

  condition: selection_run and selection_miner_args

falsepositives:
  - Legitimate container image names containing 'miner' unrelated to cryptomining (rare); ImageSource/Namespace scoping to an approved registry reduces noise for this container-focused variant. Checking argv positions a2 through a7 covers common flag counts preceding the image/command argument, but an unusually long flag list could still push the image reference past a7.

level: high

Related sub-techniques

• T1496.002 Bandwidth Hijacking
• T1496.004 Cloud Service Hijacking
• T1496.003 SMS Pumping

Explore

• All Sigma rules for MITRE ATT&CK
• Sigma rule format guide
• Full T1496.001 intelligence — ATT&CK Intelligence View
• Official MITRE ATT&CK entry
• Built by Shahrukh Khan