Patchfirst
Patchfirst
T1496Impact

Resource Hijacking

Adversaries may leverage the resources of co-opted systems to complete resource-intensive tasks, which may impact system and/or hosted service availability. Resource hijacking may take a number of different forms. For example, adversaries may: * Leverage compute resources in order to mine cryptocurrency * Sell network bandwidth to proxy networks * Generate SMS traffic for profit * Abuse…

attack.mitre.org ↗
CVEs21
In 19
Reports0
Sub-techniques T1496.001Compute HijackingT1496.002Bandwidth HijackingT1496.003SMS PumpingT1496.004Cloud Service Hijacking

Detections

13 Sigma rules tagged T1496
Resource HijackingT149613 general rules
All 13 on SigmaHQ ↗

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

CVEs linked to Resource Hijacking

21 CVEs, by priority. Each link shows its badge.
  1. CVE-2021-44228Apache Log4j2 Remote Code Execution Vulnerability
    Apache · Log4j2KEVRansomwarePublic exploitCritical · 10.0T1608.001Upload MalwareT1190Exploit Public-Facing Application+3 more · 10 reports
    MITRE CTID mapping of the KEV entry · follow-on activity
    >99.9%Top 0.01%
    90.0priority
  2. CVE-2021-26084Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection Vulnerability
    Atlassian · Confluence Server and Data CenterKEVRansomwarePublic exploitCritical · 9.8T1059Command and Scripting InterpreterT1496Resource Hijacking3 reports
    MITRE CTID mapping of the KEV entry · follow-on activity
    >99.9%Top 0.01%
    87.6priority
  3. CVE-2018-7600Drupal Core Remote Code Execution Vulnerability
    Drupal · Drupal CoreKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter+2 more · 1 report
    MITRE CTID mapping of the KEV entry · follow-on activity
    >99.9%Top 0.01%
    83.7priority
  4. CVE-2019-18935Progress Telerik UI for ASP.NET AJAX Deserialization of Untrusted Data Vulnerability
    Progress · Telerik UI for ASP.NET AJAXKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1505.003Web Shell+2 more · 1 report
    MITRE CTID mapping of the KEV entry · primary impact
    99.7%Top 0.05%
    83.7priority
  5. CVE-2018-11776Apache Struts Remote Code Execution Vulnerability
    Apache · StrutsKEVPublic exploitHigh · 8.1T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter+1 more · 1 report
    MITRE CTID mapping of the KEV entry · follow-on activity
    >99.9%Top 0.01%
    82.5priority
  6. CVE-2023-32315Ignite Realtime Openfire Path Traversal Vulnerability
    Ignite Realtime · OpenfireKEVPublic exploitHigh · 7.5T1505.003Web ShellT1202Indirect Command Execution+2 more · 1 report
    MITRE CTID mapping of the KEV entry · follow-on activity
    >99.9%Top 0.01%
    82.1priority
  7. CVE-2021-22205GitLab Community and Enterprise Editions Remote Code Execution Vulnerability
    GitLab · Community and Enterprise EditionsKEVRansomwarePublic exploitCritical · 10.0T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter+2 more
    MITRE CTID mapping of the KEV entry · follow-on activity
    99.7%Top 0.05%
    80.0priority
  8. CVE-2022-29464WSO2 Multiple Products Unrestrictive Upload of File Vulnerability
    WSO2 · Multiple ProductsKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1202Indirect Command Execution+1 more
    MITRE CTID mapping of the KEV entry · follow-on activity
    >99.9%Top 0.01%
    79.9priority
  9. CVE-2023-22527Atlassian Confluence Data Center and Server Template Injection Vulnerability
    Atlassian · Confluence Data Center and ServerKEVRansomwarePublic exploitCritical · 9.8T1496Resource Hijacking
    MITRE CTID mapping of the KEV entry · primary impact
    >99.9%Top 0.02%
    79.9priority
  10. CVE-2023-38035Ivanti Sentry Authentication Bypass Vulnerability
    Ivanti · SentryKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter+6 more
    MITRE CTID mapping of the KEV entry · follow-on activity
    >99.9%Top 0.03%
    79.9priority
  11. CVE-2024-23692Rejetto HTTP File Server Improper Neutralization of Special Elements Used in a Template Engine Vulnerability
    Rejetto · HTTP File ServerKEVRansomwarePublic exploitCritical · 9.8T1082System Information DiscoveryT1005Data from Local System+2 more
    MITRE CTID mapping of the KEV entry · follow-on activity
    99.5%Top 0.06%
    79.8priority
  12. CVE-2017-9822DotNetNuke (DNN) Remote Code Execution Vulnerability
    DotNetNuke (DNN) · DotNetNuke (DNN)KEVRansomwarePublic exploitHigh · 8.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter+1 more
    MITRE CTID mapping of the KEV entry · follow-on activity
    94.8%Top 0.14%
    79.1priority
  13. CVE-2020-8515Multiple DrayTek Vigor Routers Web Management Page Vulnerability
    DrayTek · Multiple Vigor RoutersKEVPublic exploitCritical · 9.8T1133External Remote ServicesT1059Command and Scripting Interpreter+1 more
    MITRE CTID mapping of the KEV entry · follow-on activity
    >99.9%Top 0.01%
    69.9priority
  14. CVE-2021-35394Realtek Jungle SDK Remote Code Execution Vulnerability
    Realtek · Jungle Software Development Kit (SDK)KEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter+5 more
    MITRE CTID mapping of the KEV entry · follow-on activity
    99.9%Top 0.04%
    69.9priority
  15. CVE-2022-29303SolarView Compact Command Injection Vulnerability
    SolarView · CompactKEVPublic exploitCritical · 9.8T1059Command and Scripting InterpreterT1505Server Software Component+1 more
    MITRE CTID mapping of the KEV entry · follow-on activity
    98.0%Top 0.09%
    69.8priority
  16. CVE-2025-4632Samsung MagicINFO 9 Server Path Traversal Vulnerability
    Samsung · MagicINFO 9 ServerKEVPublic exploitCritical · 9.8T1608.001Upload MalwareT1059Command and Scripting Interpreter+2 more
    MITRE CTID mapping of the KEV entry · follow-on activity
    24.1%Top 2.2%
    69.4priority
  17. CVE-2023-1389TP-Link Archer AX-21 Command Injection Vulnerability
    TP-Link · Archer AX21KEVPublic exploitHigh · 8.8T1106Native APIT1070Indicator Removal+3 more
    MITRE CTID mapping of the KEV entry · primary impact
    >99.9%Top 0.01%
    69.2priority
  18. CVE-2023-49897FXC AE1021, AE1021PE OS Command Injection Vulnerability
    FXC · AE1021, AE1021PEKEVPublic exploitHigh · 8.8T1496Resource HijackingT1498Network Denial of Service
    MITRE CTID mapping of the KEV entry · primary impact
    50.4%Top 1.1%
    68.9priority
  19. CVE-2023-47565QNAP VioStor NVR OS Command Injection Vulnerability
    QNAP · VioStor NVRKEVHigh · 8.8T1496Resource HijackingT1498Network Denial of Service
    MITRE CTID mapping of the KEV entry · primary impact
    73.3%Top 0.54%
    64.1priority
  20. CVE-2018-11084Garden-runC prevents deletion of some app environments
    Cloud Foundry · Garden-runCMedium · 6.8T1496Resource Hijacking
    MITRE CTID mapping of the CVE · primary impact
    1.2%Top 32%
    19.7priority
  21. CVE-2020-16200Philips Clinical Collaboration Platform Algorithm Downgrade
    Philips · Clinical Collaboration PlatformMedium · 6.5T1496Resource Hijacking
    MITRE CTID mapping of the CVE · primary impact
    0.6%Top 50%
    14.5priority
↑ ↓ chooseEnter openEsc close