T1496 Resource Hijacking
EnterpriseAdversaries may leverage the resources of co-opted systems to complete resource-intensive tasks, which may impact system and/or hosted service availability. Resource hijacking may take a number of different forms. For example, adversaries may: * Leverage compute resources in order to mine cryptocurrency * Sell network bandwidth to proxy networks * Generate SMS traffic for profit * Abuse cloud-based messaging services to send large quantities of spam messages In some cases, adversaries may leverage multiple types of Resource Hijacking at once.
01
platforms
Platforms this applies to.
WindowsIaaSLinuxmacOSContainersSaaS
02
tactics
ATT&CK tactics this technique serves.
03
sub-techniques (4)
More specific entries beneath this one.
04
detected by (8)
Data components that detect this.
05
known-exploited CVEs (19)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-4632US | critical9.8OT critical | KEV | ||
Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1052 allows attackers to write arbitrary file as system au… | ||||
| CVE-2024-23692US | critical9.8OT critical | KEV | ||
Rejetto HTTP File Server, up to and including version 2.3m, is vulnerable to a template injection vulnerability. This vulnerability allows a remote, unauthenticated attacker to exe… | ||||
| CVE-2023-22527US | critical9.8OT critical | KEV | ||
A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE on an affected instance. Customers using… | ||||
| CVE-2023-47565US | high8.8OT critical | KEV | ||
An OS command injection vulnerability has been found to affect legacy QNAP VioStor NVR models running QVR Firmware 4.x. If exploited, the vulnerability could allow authenticated us… | ||||
| CVE-2023-49897US | high8.8OT critical | KEV | ||
An OS command injection vulnerability exists in AE1021PE firmware version 2.0.9 and earlier and AE1021 firmware version 2.0.9 and earlier. If this vulnerability is exploited, an ar… | ||||
| CVE-2023-38035US | critical9.8OT critical | KEV | ||
A security vulnerability in MICS Admin Portal in Ivanti MobileIron Sentry versions 9.18.0 and below, which may allow an attacker to bypass authentication controls on the administra… | ||||
| CVE-2023-32315US | high7.5OT critical | KEV | ||
Openfire is an XMPP server licensed under the Open Source Apache License. Openfire's administrative console, a web-based application, was found to be vulnerable to a path traversal… | ||||
| CVE-2023-1389US | high8.8OT critical | KEV | ||
TP-Link Archer AX21 (AX1800) firmware versions before 1.1.4 Build 20230219 contained a command injection vulnerability in the country form of the /cgi-bin/luci;stok=/locale endpoin… | ||||
| CVE-2022-29303US | critical9.8OT critical | KEV | ||
SolarView Compact ver.6.00 was discovered to contain a command injection vulnerability via conf_mail.php. | ||||
| CVE-2022-29464US | critical9.8OT critical | KEV | ||
Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a Content-Disposition directory travers… | ||||
| CVE-2021-44228US | critical10.0OT critical | KEV | ||
Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect agai… | ||||
| CVE-2021-26084US | critical9.8OT critical | KEV | ||
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Conflu… | ||||
| CVE-2021-35394US | critical9.8OT critical | KEV | ||
Realtek Jungle SDK version v2.x up to v3.4.14B provides a diagnostic tool called 'MP Daemon' that is usually compiled as 'UDPServer' binary. The binary is affected by multiple memo… | ||||
| CVE-2021-22205US | critical10.0OT critical | KEV | ||
An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a file parser which resul… | ||||
| CVE-2020-8515US | critical9.8OT critical | KEV | ||
DrayTek Vigor2960 1.3.1_Beta, Vigor3900 1.4.4_Beta, and Vigor300B 1.3.3_Beta, 1.4.2.1_Beta, and 1.4.4_Beta devices allow remote code execution as root (without authentication) via… | ||||
| CVE-2019-18935US | critical9.8OT critical | KEV | ||
Progress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization vulnerability in the RadAsyncUpload function. This is exploitable when the encryption keys… | ||||
| CVE-2018-11776US | high8.1OT critical | KEV | ||
Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention… | ||||
| CVE-2018-7600US | critical9.8OT critical | KEV | ||
Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems… | ||||
| CVE-2017-9822US | high8.8OT critical | KEV | ||
DNN (aka DotNetNuke) before 9.1.1 has Remote Code Execution via a cookie, aka "2017-08 (Critical) Possible remote code execution on DNN sites." | ||||
06
Detected by (Sigma) (13)
Sigma detection rules related to this.
07
source
Where this definition is published.