Resource Hijacking: Compute Hijacking T1496.001

Tactic: Impact

Adversaries may leverage the compute resources of co-opted systems to complete resource-intensive tasks, which may impact system and/or hosted service availability.

Authoring guide

These 2 rules share fields, values, and exclusions.

Fields filtered most (10 distinct)

These fields appear most often in rule filters.

FieldRulesHowSample values
process_name2eq 1, in 1, is_not_null 1bash, csh, dash
CommandLine1contains 1/proc/sys/vm/swappiness, echo , vm.swappiness
Esql.agent_id_values1eq 11
Esql.recent1le 16
EventType1in 1ProcessRollup2, exec, exec_event
ParentImage1is_not_null 1
event.type1eq 1start
host.os.type1eq 1
process.args1contains 1, eq 1--write, -c, -w
system.process.cpu.total.norm.pct1ge 10.9

Top indicator values (26 distinct)

These values appear most often in rule predicates.

FieldKindValueRules (here)Corpus reach
CommandLinecontains
/proc/sys/vm/swappiness
1
CommandLinecontains
echo
15
CommandLinecontains
vm.swappiness
1
Esql.agent_id_valueseq
1
1
Esql.recentle
6
16
EventTypein
ProcessRollup2
1118
EventTypein
exec
1206
EventTypein
exec_event
1150
EventTypein
start
1168
event.typeeq
start
11087
process.argscontains
--write
13
process.argscontains
-w
14
process.argscontains
=
13
process.argseq
-c
1107
process_nameeq
sysctl
15
process_namein
bash
1202
process_namein
csh
1159
process_namein
dash
1170
process_namein
fish
1163
process_namein
ksh
1163
process_namein
sh
1197
process_namein
swapoff
1
process_namein
swapon
1
process_namein
tcsh
1156
process_namein
zsh
1196
system.process.cpu.total.norm.pctge
0.9
1

Rules under this technique

These vendors publish rules tagged with this technique.

Domain: Endpoint

Platform (all)

Elastic 2 rules