T1496.002 — Bandwidth Hijacking

Tactic: Impact · Platforms: Linux, Windows, macOS, IaaS, Containers

Adversaries may leverage the network bandwidth resources of co-opted systems to complete resource-intensive tasks, which may impact system and/or hosted service availability. Adversaries may also use malware that leverages a system's network bandwidth as part of a botnet in order to facilitate…

Sub-technique of Resource Hijacking (T1496).

Sigma detection rules (5)

title: "T1496.002 Resource Hijacking: Bandwidth Hijacking"
id: ef54dca9-c6cd-4377-b5bd-81e127713572
description: 'Detects known proxyware and P2P/torrent client processes establishing outbound network connections, a Windows-observable proxy for bandwidth hijacking (botnet participation, proxyjacking, or torrent seeding) since Sysmon network-connection events carry no byte/throughput counters to measure actual bandwidth volume. (Data Component: Network Connection Creation; baseline tier: windows-eventid.) Tune using: TimeWindow, DestinationCountry, ProcessName.'
references:
  - https://attack.mitre.org/techniques/T1496/002
author: Shahrukh Khan
date: 2026-06-29
license: MIT
tags:
  - attack.impact
  - attack.t1496.002

logsource:
  category: network_connection
  product: windows
  service: sysmon

detection:
  selection:
    EventID: '3'
    Image|endswith:
      - '\iproyalpawns.exe'
      - '\packetstream.exe'
      - '\peer2profit.exe'
      - '\honeygain.exe'
      - '\repocket.exe'
      - '\traffmonetizer.exe'
      - '\bittorrent.exe'
      - '\utorrent.exe'
      - '\qbittorrent.exe'
      - '\transmission-qt.exe'

  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection and not filter_system_account

falsepositives:
  - System and service accounts (SYSTEM, LOCAL SERVICE, NETWORK SERVICE) performing the same action are excluded via filter_system_account; tune further with process/path allowlists if noise remains.
  - Legitimate, organization-approved use of a listed P2P or proxyware application.

level: medium

title: "T1496.002 Resource Hijacking: Bandwidth Hijacking"
id: 56f8fb0b-1264-4d71-bed4-dae3310faadb
description: 'Detect execution of tools consistent with a victim host''s bandwidth being hijacked (proxyjacking, botnet/torrent seeding, or mass network scanning to find further targets). The prior logic detected hping3/slowloris, which are outbound DoS/packet-crafting tools used to attack a target (T1498 Network Denial of Service), not tools that consume the local host''s own bandwidth on an adversary''s behalf -- the opposite direction of this technique. Retargeted to proxyware client binaries, torrent-seeding daemons, and mass-scanning binaries. Tune using: ToolPattern, TrafficRateThreshold.'
references:
  - https://attack.mitre.org/techniques/T1496/002
author: Shahrukh Khan
date: 2026-04-06
license: MIT
tags:
  - attack.impact
  - attack.t1496.002

logsource:
  category: process_creation
  product: linux
  service: auditd

detection:
  selection_proxyware:
    type: EXECVE
    a0|endswith:
      - '/honeygain'
      - '/iproyal'
      - '/pawns-cli'
      - '/peer2profit'
      - '/packetstream'
      - '/traffmonetizer'
  selection_torrent_seed:
    type: EXECVE
    a0|endswith:
      - '/transmission-cli'
      - '/transmission-daemon'
      - '/rtorrent'
      - '/qbittorrent-nox'
      - '/deluged'
  selection_mass_scanner:
    type: EXECVE
    a0|endswith:
      - '/masscan'
      - '/zmap'

  condition: 1 of selection_*

falsepositives:
  - Legitimate use of BitTorrent clients to distribute large files (e.g. Linux distribution images); authorized internal scanning performed by the security/vuln-management team with masscan/zmap -- TrafficRateThreshold correlation against a network-flow sensor is needed to confirm actual bandwidth saturation, which process telemetry alone cannot provide.

level: high

title: "T1496.002 Resource Hijacking: Bandwidth Hijacking"
id: eff8aa8d-04c6-4ddb-ab8a-6f279f89fb03
description: 'Detect Excessive or Unauthorized Bandwidth Usage for Botnet, Proxyjacking, or Scanning Purposes. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ProcessSignedStatus, DataRateThreshold.'
references:
  - https://attack.mitre.org/techniques/T1496/002
author: Shahrukh Khan
date: 2026-02-12
license: MIT
tags:
  - attack.impact
  - attack.t1496.002

logsource:
  product: macos

detection:
  selection:
    Image|endswith:
      - '/curl'
      - '/nc'
    DestinationPort:
      - 80
      - 443
  condition: selection

falsepositives:
  - Sustained high-volume outbound transfer consistent with bandwidth hijacking such as proxyware cannot be reliably distinguished from legitimate large file downloads using curl at the process level without a data-rate baseline, which unified log network events do not directly expose.

level: medium

title: "T1496.002 Resource Hijacking: Bandwidth Hijacking"
id: 4f500534-130a-4f8c-bbc4-55bd22ce74c5
description: 'Detect Excessive or Unauthorized Bandwidth Usage for Botnet, Proxyjacking, or Scanning Purposes. (Retargeted to the cloudtrail AWS telemetry that actually captures this techniques behavior; see logsource below.) Tune using: InstanceType, TrafficEgressThreshold.'
references:
  - https://attack.mitre.org/techniques/T1496/002
author: Shahrukh Khan
date: 2026-04-18
license: MIT
tags:
  - attack.impact
  - attack.t1496.002

logsource:
  category: cloudtrail
  product: aws

detection:
  selection:
    eventSource: 'ec2.amazonaws.com'
    eventName: 'RunInstances'
    requestParameters.instanceType|contains:
      - 'n.'
      - 'metal'

  condition: selection

falsepositives:
  - High-bandwidth instance types are also used legitimately for network appliance workloads and large data transfers, so this is only reliable when combined with actual sustained egress volume from the instance, which CloudTrail alone cannot measure.

level: medium

title: "T1496.002 Resource Hijacking: Bandwidth Hijacking"
id: f2da6795-1a97-4f08-8d16-3c2f309cfd5b
description: 'Detect Excessive or Unauthorized Bandwidth Usage for Botnet, Proxyjacking, or Scanning Purposes. Added indicators for internet-wide scanning tools (masscan, zmap) alongside the existing named proxyware binaries, since the technique''s primary described behaviors also include botnet-driven bandwidth abuse for DDoS/scanning, not just commercial proxyware apps. (Data Component: Process Creation; baseline tier: fallback.) Tune using: ContainerBaselineNetworkUsage, ImageName.'
references:
  - https://attack.mitre.org/techniques/T1496/002
author: Shahrukh Khan
date: 2026-04-09
license: MIT
tags:
  - attack.impact
  - attack.t1496.002

logsource:
  category: process_creation
  product: linux
  service: auditd

detection:
  selection_proxyware:
    type: EXECVE
    a0|contains:
      - 'honeygain'
      - 'peer2profit'
      - 'packetstream'
      - 'traffmonetizer'
  selection_scanning:
    type: EXECVE
    a0|endswith:
      - '/masscan'
      - '/zmap'

  condition: 1 of selection_*

falsepositives:
  - Users who intentionally installed a bandwidth-sharing or proxyware application for personal profit; security teams and researchers legitimately running masscan/zmap for authorized internet-wide scanning or asset discovery. Auditd only sees the process execution and cannot confirm actual bandwidth consumption without additional network telemetry.

level: medium

Related sub-techniques

• T1496.001 Compute Hijacking
• T1496.004 Cloud Service Hijacking
• T1496.003 SMS Pumping

Explore

• All Sigma rules for MITRE ATT&CK
• Sigma rule format guide
• Full T1496.002 intelligence — ATT&CK Intelligence View
• Official MITRE ATT&CK entry
• Built by Shahrukh Khan