Resource Hijacking: Cloud Service Hijacking `T1496.004`

Tactic: Impact

Adversaries may leverage compromised software-as-a-service (SaaS) applications to complete resource-intensive tasks, which may impact hosted service availability.

Authoring guide

These 5 rules share fields, values, and exclusions.

Fields filtered most (7 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`EventType`	4	`eq` 3, `in` 1	`createprovisionedmodelthroughput`, `createtopic`, `deleteprovisionedmodelthroughput`, `publish`, `subscribe`
`Provider_Name`	4	`eq` 4	`sns.amazonaws.com`, `bedrock.amazonaws.com`
`data_stream.dataset`	4	`eq` 4	`aws.cloudtrail`
`event.outcome`	4	`eq` 4	`success`
`operation`	1	`in` 1	`Converse`, `InvokeModel`
`output.outputBodyJson.usage.outputTokens`	1	`eq` 1	`0`
`output.outputBodyJson.usage.totalTokens`	1	`gt` 1	`1000`

Top indicator values (14 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`data_stream.dataset`	`eq`	`aws.cloudtrail` elasticAWS Bedrock Provisioned Model Throughput Tampering elasticAWS SNS Rare Protocol Subscription by User elasticAWS SNS Topic Created by Rare User elasticAWS SNS Topic Message Publish by Rare User	4	173
`event.outcome`	`eq`	`success` elasticAWS Bedrock Provisioned Model Throughput Tampering elasticAWS SNS Rare Protocol Subscription by User elasticAWS SNS Topic Created by Rare User elasticAWS SNS Topic Message Publish by Rare User	4	375
`Provider_Name`	`eq`	`sns.amazonaws.com` elasticAWS SNS Rare Protocol Subscription by User elasticAWS SNS Topic Created by Rare User elasticAWS SNS Topic Message Publish by Rare User	3	3
`Provider_Name`	`eq`	`bedrock.amazonaws.com` elasticAWS Bedrock Provisioned Model Throughput Tampering	1	16
`EventType`	`eq`	`createtopic` elasticAWS SNS Topic Created by Rare User	1
`EventType`	`eq`	`publish` elasticAWS SNS Topic Message Publish by Rare User	1
`EventType`	`eq`	`subscribe` elasticAWS SNS Rare Protocol Subscription by User	1
`EventType`	`in`	`createprovisionedmodelthroughput` elasticAWS Bedrock Provisioned Model Throughput Tampering	1
`EventType`	`in`	`deleteprovisionedmodelthroughput` elasticAWS Bedrock Provisioned Model Throughput Tampering	1	2
`EventType`	`in`	`updateprovisionedmodelthroughput` elasticAWS Bedrock Provisioned Model Throughput Tampering	1
`operation`	`in`	`Converse` pantherAWS Bedrock Model Invocation Abnormal Token Usage	1
`operation`	`in`	`InvokeModel` pantherAWS Bedrock Model Invocation Abnormal Token Usage	1
`output.outputBodyJson.usage.outputTokens`	`eq`	`0` pantherAWS Bedrock Model Invocation Abnormal Token Usage	1
`output.outputBodyJson.usage.totalTokens`	`gt`	`1000` pantherAWS Bedrock Model Invocation Abnormal Token Usage	1

Exclusions (1 distinct)

These values appear most often in top-level exclusions.

Field	Kind	Value	Rules excluding
`aws::userAgent`	`contains`	`terraform` elasticAWS SNS Rare Protocol Subscription by User	1

Rules under this technique

These vendors publish rules tagged with this technique.

Platform: AWS

Domain: Cloud

Elastic 4 rules

Panther 1 rule

AWS Bedrock Model Invocation Abnormal Token Usage

Resource Hijacking: Cloud Service Hijacking T1496.004