T1496 Resource Hijacking
EnterpriseAdversaries may leverage the resources of co-opted systems to complete resource-intensive tasks, which may impact system and/or hosted service availability. Resource hijacking may take a number of different forms. For example, adversaries may: * Leverage compute resources in order to mine cryptocurrency * Sell network bandwidth to proxy networks * Generate SMS traffic for profit * Abuse cloud-based messaging services to send large quantities of spam messages In some cases, adversaries may leverage multiple types of Resource Hijacking at once.
01
Plattformen
Plattformen, für die dies gilt.
WindowsIaaSLinuxmacOSContainersSaaS
02
Taktiken
ATT&CK-Taktiken, denen diese Technik dient.
03
Untertechniken (4)
Spezifischere Einträge unterhalb dieses.
04
Erkannt durch (8)
Datenkomponenten, die dies erkennen.
05
bekannt ausgenutzte CVEs (19)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2025-4632US | critical9.8OT kritisch | KEV | ||
Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1052 allows attackers to write arbitrary file as system au… | ||||
| CVE-2024-23692US | critical9.8OT kritisch | KEV | ||
Rejetto HTTP File Server, up to and including version 2.3m, is vulnerable to a template injection vulnerability. This vulnerability allows a remote, unauthenticated attacker to exe… | ||||
| CVE-2023-22527US | critical9.8OT kritisch | KEV | ||
A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE on an affected instance. Customers using… | ||||
| CVE-2023-47565US | high8.8OT kritisch | KEV | ||
An OS command injection vulnerability has been found to affect legacy QNAP VioStor NVR models running QVR Firmware 4.x. If exploited, the vulnerability could allow authenticated us… | ||||
| CVE-2023-49897US | high8.8OT kritisch | KEV | ||
An OS command injection vulnerability exists in AE1021PE firmware version 2.0.9 and earlier and AE1021 firmware version 2.0.9 and earlier. If this vulnerability is exploited, an ar… | ||||
| CVE-2023-38035US | critical9.8OT kritisch | KEV | ||
A security vulnerability in MICS Admin Portal in Ivanti MobileIron Sentry versions 9.18.0 and below, which may allow an attacker to bypass authentication controls on the administra… | ||||
| CVE-2023-32315US | high7.5OT kritisch | KEV | ||
Openfire is an XMPP server licensed under the Open Source Apache License. Openfire's administrative console, a web-based application, was found to be vulnerable to a path traversal… | ||||
| CVE-2023-1389US | high8.8OT kritisch | KEV | ||
TP-Link Archer AX21 (AX1800) firmware versions before 1.1.4 Build 20230219 contained a command injection vulnerability in the country form of the /cgi-bin/luci;stok=/locale endpoin… | ||||
| CVE-2022-29303US | critical9.8OT kritisch | KEV | ||
SolarView Compact ver.6.00 was discovered to contain a command injection vulnerability via conf_mail.php. | ||||
| CVE-2022-29464US | critical9.8OT kritisch | KEV | ||
Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a Content-Disposition directory travers… | ||||
| CVE-2021-44228US | critical10.0OT kritisch | KEV | ||
Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect agai… | ||||
| CVE-2021-26084US | critical9.8OT kritisch | KEV | ||
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Conflu… | ||||
| CVE-2021-35394US | critical9.8OT kritisch | KEV | ||
Realtek Jungle SDK version v2.x up to v3.4.14B provides a diagnostic tool called 'MP Daemon' that is usually compiled as 'UDPServer' binary. The binary is affected by multiple memo… | ||||
| CVE-2021-22205US | critical10.0OT kritisch | KEV | ||
An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a file parser which resul… | ||||
| CVE-2020-8515US | critical9.8OT kritisch | KEV | ||
DrayTek Vigor2960 1.3.1_Beta, Vigor3900 1.4.4_Beta, and Vigor300B 1.3.3_Beta, 1.4.2.1_Beta, and 1.4.4_Beta devices allow remote code execution as root (without authentication) via… | ||||
| CVE-2019-18935US | critical9.8OT kritisch | KEV | ||
Progress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization vulnerability in the RadAsyncUpload function. This is exploitable when the encryption keys… | ||||
| CVE-2018-11776US | high8.1OT kritisch | KEV | ||
Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention… | ||||
| CVE-2018-7600US | critical9.8OT kritisch | KEV | ||
Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems… | ||||
| CVE-2017-9822US | high8.8OT kritisch | KEV | ||
DNN (aka DotNetNuke) before 9.1.1 has Remote Code Execution via a cookie, aka "2017-08 (Critical) Possible remote code execution on DNN sites." | ||||
06
Erkannt durch (Sigma) (13)
Zugehörige Sigma-Erkennungsregeln.
07
Quelle
Wo diese Definition veröffentlicht ist.