T1496.003 — SMS Pumping

Tactic: Impact · Platforms: SaaS

Adversaries may leverage messaging services for SMS pumping, which may impact system and/or hosted service availability. SMS pumping is a type of telecommunications fraud whereby a threat actor first obtains a set of phone numbers from a telecommunications provider, then leverages a victim’s…

Sub-technique of Resource Hijacking (T1496).

Sigma detection rules (1)

T1496.003 Resource Hijacking: SMS Pumping

title: "T1496.003 Resource Hijacking: SMS Pumping"
id: c7f7387f-ee37-4421-97fc-00bf1f257d14
description: 'Detection Strategy for Resource Hijacking: SMS Pumping via SaaS Application Logs. (Data Component: Application Log Content; baseline tier: fallback.) Tune using: TimeWindow, SMSFrequencyThreshold, DestinationCountryCodeFilter, UserAgentAnomalyThreshold, IPGeoVarianceScore.'
references:
  - https://attack.mitre.org/techniques/T1496/003
author: Shahrukh Khan
date: 2026-04-29
license: MIT
tags:
  - attack.impact
  - attack.t1496.003

logsource:
  product: saas
  service: application

detection:
  selection_sms:
    event_type: 'sms_sent'

  condition: selection_sms

falsepositives:
  - Legitimate MFA or notification SMS traffic surges from marketing campaigns; genuine detection requires per-account SMS-frequency and destination-country-code thresholding over a time window, which a single-event rule cannot express.

level: medium

Related sub-techniques

Explore