Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
ATT&CK technique

T1496

Resource Hijacking

Impact 78 detections found
View on MITRE ATT&CK →

Detection rules

Source Rule Status Updated
elastic Memory Swap Modification production 2026-10-09
elastic GCP Vertex AI High Request and Token Volume production 2026-10-07
elastic Microsoft Foundry High Request and Token Volume production 2026-10-05
elastic Anthropic Excessive Chat Creation production 2026-09-25
elastic Anthropic Extra Usage Spend Limit Deleted production 2026-09-25
elastic AWS Bedrock Provisioned Model Throughput Tampering production 2026-09-25
elastic AWS SNS Rare Protocol Subscription by User production 2026-09-18
elastic AWS Potential Cryptomining via ECS Task Definition Deployment production 2026-09-18
elastic AWS Lambda Function High-Frequency Invocation by a Single Principal production 2026-09-18
elastic AWS SNS Topic Created by Rare User production 2026-09-18
elastic Suspicious Mining Process Creation Event production 2026-09-18
elastic Potential Malware-Driven SSH Brute Force Attempt production 2026-09-18
elastic Potential Redis CONFIG SET Cron Directory Persistence (RedisRaider) production 2026-09-18
elastic Newly Observed Process Exhibiting High CPU Usage production 2026-09-18
elastic AWS SNS Topic Message Publish by Rare User production 2026-09-18
sigma Network Communication With Crypto Mining Pool stable 2026-07-24
snort ET TROJAN W32/BitCoinMiner.MultiThreat Getblocktemplate Protocol Server Connection rev 4 2024-12-24
snort ET TROJAN Fake FlashPlayer Update Leading to CoinMiner M1 2018-10-12 rev 3 2024-12-24
snort ET TROJAN Fake FlashPlayer Update Leading to CoinMiner M2 2018-10-12 rev 3 2024-12-24
snort ET TROJAN CoinMiner Malicious Authline Seen After CVE-2017-10271 Exploit rev 2 2024-12-24
snort ET TROJAN W32/BitCoinMiner.MultiThreat Stratum Protocol Mining.Notify Work Server Response rev 3 2024-12-24
snort ET TROJAN Win32/Unk.Coinminer Checkin rev 2 2024-12-24
suricata ET MALWARE Win32/Unk.Coinminer Checkin rev 3 2024-12-24
snort ET TROJAN PrimeCoinMiner.Protominer rev 3 2024-12-24
snort ET TROJAN W32/BitCoinMiner.MultiThreat Stratum Protocol Mining.Notify Initial Connection Server Response rev 2 2024-12-24
snort ET TROJAN W32/BitCoinMiner.MultiThreat Getblocktemplate Protocol Server Coinbasetxn Begin Mining Response rev 3 2024-12-24
suricata ET MALWARE Clipsa Stealer - Coinminer Download rev 5 2024-05-01
suricata ET MALWARE W32/Zeus.BitcoinMiner Variant CnC Beacon rev 5 2024-04-30
suricata ET ADWARE_PUP SecureDriverUpdater Checkin rev 4 2024-04-30
suricata ET ADWARE_PUP Win32/MobiGame Install Stats Checkin M2 rev 2 2024-04-25
suricata ET ADWARE_PUP Win32/MobiGame Install Stats Checkin M3 rev 2 2024-04-25
suricata ET ADWARE_PUP my247eshop .com User-Agent rev 9 2024-04-13
suricata ET MALWARE MegalodonHTTP CoinMiner Activity rev 3 2024-04-06
suricata ET ADWARE_PUP Win32/MobiGame Install Stats Checkin M1 rev 2 2024-03-25
suricata ET ADWARE_PUP ThunderUnion Install Checkin rev 2 2024-03-25
suricata ET ADWARE_PUP Adware pricepeep Adware.Shopper.297 rev 5 2024-03-17
suricata ET MALWARE C3Pool CoinMiner Setup Script Download rev 2 2024-03-14
suricata ET MALWARE MSIL/Unk.CoinMiner Downloader rev 3 2024-03-08
snort ET TROJAN MSIL/Unk.CoinMiner Downloader rev 3 2024-01-25
sigma Potential Crypto Mining Activity stable 2023-02-13
sigma Linux Crypto Mining Indicators test 2022-12-25
sigma Azure Container Registry Created or Deleted test 2022-08-23
sigma Azure Kubernetes Cluster Created or Deleted test 2022-08-23
sigma Azure Kubernetes Network Policy Change test 2022-08-23
sigma Azure Kubernetes Sensitive Role Access test 2022-08-23
sigma Azure Kubernetes RoleBinding/ClusterRoleBinding Modified and Deleted test 2022-08-23
sigma Azure Kubernetes Secret or Config Object Access test 2022-08-23
sigma Azure Kubernetes Service Account Modified or Deleted test 2022-08-23
sigma DNS Events Related To Mining Pools test 2022-07-07
snort ET MALWARE Win32/MobiGame Install Stats Checkin M3 rev 3 2022-04-18
snort ET TROJAN MSIL/CoinMiner Performing System Checkin rev 3 2022-04-18
suricata ET ADWARE_PUP Win32/DownWare.V Checkin rev 2 2022-01-12
snort ET MALWARE Win32/DownWare.V Checkin rev 2 2022-01-12
suricata ET ADWARE_PUP Lantern Checkin rev 1 2021-11-01
snort ET MALWARE Lantern Checkin rev 1 2021-11-01
snort ET MALWARE SecureDriverUpdater Checkin rev 2 2021-10-29
sigma Linux Crypto Mining Pool Connections stable 2021-10-26
sigma Monero Crypto Coin Mining Pool Lookup stable 2021-10-24
snort ET MALWARE Win32/MobiGame Install Stats Checkin M2 rev 2 2021-09-08
snort ET MALWARE Win32/MobiGame Install Stats Checkin M1 rev 2 2021-09-08
snort ET MALWARE ThunderUnion Install Checkin rev 2 2021-09-03
suricata ET WEB_CLIENT Fake FlashPlayer Update Leading to CoinMiner M2 2018-10-12 rev 3 2020-09-16
suricata ET MALWARE MSIL/CoinMiner Performing System Checkin rev 1 2020-08-28
snort ET TROJAN C3Pool CoinMiner Setup Script Download rev 2 2020-08-28
suricata ET WEB_CLIENT Fake FlashPlayer Update Leading to CoinMiner M1 2018-10-12 rev 2 2020-08-26
suricata ET COINMINER PrimeCoinMiner.Protominer rev 2 2020-08-19
snort ET TROJAN Clipsa Stealer - Coinminer Download rev 2 2019-08-16
snort ET MALWARE Adware pricepeep Adware.Shopper.297 rev 2 2019-08-14
suricata ET COINMINER W32/BitCoinMiner.MultiThreat Stratum Protocol Mining.Notify Work Server Response rev 3 2019-07-26
suricata ET COINMINER W32/BitCoinMiner.MultiThreat Stratum Protocol Mining.Notify Initial Connection Server Response rev 2 2019-07-26
suricata ET COINMINER W32/BitCoinMiner.MultiThreat Getblocktemplate Protocol Server Connection rev 3 2019-07-26
suricata ET COINMINER CoinMiner Malicious Authline Seen After CVE-2017-10271 Exploit rev 1 2019-07-26
suricata ET COINMINER W32/BitCoinMiner.MultiThreat Getblocktemplate Protocol Server Coinbasetxn Begin Mining Response rev 3 2019-07-26
snort ET MALWARE my247eshop .com User-Agent rev 4 2017-10-30
snort ET TROJAN MegalodonHTTP CoinMiner Activity rev 2 2015-11-23
snort ET TROJAN W32/Zeus.BitcoinMiner Variant CnC Beacon rev 1 2014-05-28
sentinel DNS events related to mining pools (ASIM DNS Schema) Scheduled —
sentinel A host is potentially running a crypto miner (ASIM Web Session schema) Scheduled —