T1496.001sub-technique of T1496 Resource Hijacking
Compute Hijacking
Windows · IaaS · Linux · macOS · Containers1 piece on this siteT1496.001 on attack.mitre.org
Adversaries may leverage the compute resources of co-opted systems to complete resource-intensive tasks, which may impact system and/or hosted service availability. One common purpose for Compute Hijacking is to validate transactions of cryptocurrency networks and earn virtual currency. Adversaries may consume enough system resources to negatively impact and/or cause affected machines to become unresponsive.
If this is happening now
Checklists and playbooks to open while the alert is still live.
First-hour playbookMembers
Unexplained compute in a cloud account
A billing alert, instances nobody created, or a provider notification about mining.
T1496.001
how MITRE says to see it
Multi-Platform Behavioral Detection for Compute Hijacking
- Sustained execution of resource-intensive processes (e.g., cryptocurrency miners), often launched via scheduled tasks, WMI, or PowerShell. These processes frequently establish persistent external connections and attempt to evade detection using masqueraded or renamed binaries.
- Unusual long-running processes consuming high CPU cycles (e.g., via 'top' or 'ps') initiated via cron, shell scripts, or Docker. Connections to known mining pools or DNS over HTTPS usage as evasion.
- Persistent or background daemons (e.g., plist or launchd jobs) spawning high-CPU processes like xmrig or cpuminer. Outbound encrypted traffic to IPs/domains commonly used by mining proxies.
- Ephemeral or unauthorized container instantiation using public images (e.g., from DockerHub) that initiate high CPU usage shortly after startup. Often scheduled via Kubernetes or Docker socket abuse.