Adversaries may leverage the resources of co-opted systems to complete resource-intensive tasks, which may impact system and/or hosted service availability.
Resource hijacking may take a number of different forms. For example, adversaries may:
In some cases, adversaries may leverage multiple types of Resource Hijacking at once.[1]
This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.
| ID | Data Source | Data Component | Detects |
|---|---|---|---|
| DS0015 | Application Log | Application Log Content |
Monitor logs for software-as-a-service (SaaS) applications for signs of abuse. |
| DS0025 | Cloud Service | Cloud Service Modification |
Monitor for changes to SaaS services, especially when quotas are raised or when new services are enabled. |
| DS0017 | Command | Command Execution |
Monitor executed commands and arguments that may indicate common cryptomining or proxyware functionality. |
| DS0022 | File | File Creation |
Monitor for common cryptomining or proxyware files on local systems that may indicate compromise and resource usage. |
| DS0029 | Network Traffic | Network Connection Creation |
Monitor for newly constructed network connections that are sent or received by untrusted hosts, look for connections to/from strange ports, as well as reputation of IPs and URLs related cryptocurrency hosts. |
| Network Traffic Content |
Monitor network traffic content for resources of co-opted systems to complete resource-intensive tasks, which may impact system and/or hosted service availability. Note: Destination Host Name is not a comprehensive list of potential cryptocurrency URLs. This analytic has a hardcoded domain name which may change. |
||
| Network Traffic Flow |
Monitor network data for uncommon data flows. Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. |
||
| DS0009 | Process | Process Creation |
Monitor for common cryptomining or proxyware software process names that may indicate compromise and resource usage. |
| DS0013 | Sensor Health | Host Status |
Consider monitoring process resource usage to determine anomalous activity associated with malicious hijacking of computer resources such as CPU, memory, and graphics processing resources. |