T1496.004 — Cloud Service Hijacking

Tactic: Impact · Platforms: SaaS

Adversaries may leverage compromised software-as-a-service (SaaS) applications to complete resource-intensive tasks, which may impact hosted service availability. For example, adversaries may leverage email and messaging services, such as AWS Simple Email Service (SES), AWS Simple Notification…

Sub-technique of Resource Hijacking (T1496).

Sigma detection rules (1)

T1496.004 Resource Hijacking: Cloud Service Hijacking

title: "T1496.004 Resource Hijacking: Cloud Service Hijacking"
id: c09a1e63-dea0-44b3-97df-f776182bacd7
description: 'Detection Strategy for Cloud Service Hijacking via SaaS Abuse. (Retargeted to the cloudtrail AWS telemetry that actually captures this techniques behavior; see logsource below.) Tune using: TimeWindow, UserContext, RequestVolumeThreshold, GeoVelocityThreshold, ModelUsageQuotaSpike.'
references:
  - https://attack.mitre.org/techniques/T1496/004
author: Shahrukh Khan
date: 2026-04-06
license: MIT
tags:
  - attack.impact
  - attack.t1496.004

logsource:
  category: cloudtrail
  product: aws

detection:
  selection:
    eventSource:
      - 'bedrock.amazonaws.com'
      - 'sagemaker.amazonaws.com'
    eventName:
      - 'InvokeModel'
      - 'CreateEndpoint'
      - 'CreateTrainingJob'

  condition: selection

falsepositives:
  - Legitimate machine-learning teams invoke foundation models and create training jobs constantly, so CloudTrail alone cannot distinguish authorized heavy usage from abuse without cost or quota-spike data, which lowers confidence.

level: medium

Related sub-techniques

Explore