- AN0741 · Analytic 0741 — Persistent high CPU utilization combined with suspicious command-line execution (e.g., mining tools or obfuscated scripts) and outbound connections to mining/proxy networks.
- AN0742 · Analytic 0742 — Abnormal CPU/memory usage by unauthorized processes with outbound connections to known mining pools or using cron jobs/scripts to maintain persistence.
- AN0743 · Analytic 0743 — Background launch agents/daemons with high CPU use and network access to external mining services.
- AN0744 · Analytic 0744 — Sudden spikes in cloud VM CPU usage with outbound traffic to mining pools and unauthorized instance creation.
- AN0745 · Analytic 0745 — High CPU usage by unauthorized containers running mining binaries or public proxy tools.
- AN0746 · Analytic 0746 — Abuse of cloud messaging platforms to send mass spam or consume quota-based resources.
AdversaryGraph public intelligence page
This page is part of Threat Matrix, the public browser workspace for the main AdversaryGraph platform. Use it for ATT&CK pivots, actor and technique context, similarity leads, detection coverage review, and analyst-ready investigation paths.
Validation disclaimer: TTP overlap, actor similarity, generated summaries, and coverage findings are investigation leads, not attribution proof or operational validation without analyst review.
Main AdversaryGraph project Documentation Malware Analysis GitHub
Resource Hijacking
Adversaries may leverage the resources of co-opted systems to complete resource-intensive tasks, which may impact system and/or hosted service availability. Resource hijacking may take a number of different forms. For example, adversaries may: * Leverage compute resources in order to mine cryptocurrency * Sell network bandwidth to proxy networks * Generate SMS traffic for profit * Abuse cloud-based messaging services to send large quantities of spam messages In some cases, adversaries may leverage multiple types of Resource Hijacking at once.
Open detection, hunting, mitigation, and evidence workspace
Detection logic
Consider monitoring process resource usage to determine anomalous activity associated with malicious hijacking of computer resources such as CPU, memory, and graphics processing resources. Monitor for suspicious use of network resources associated with cryptocurrency mining software. Monitor for common cryptomining software process names and files on local systems that may indicate compromise and resource usage.
Observed actors
Correlated CTI and IR reports
Cyber Knowledge context
Use these routes to move from the ATT&CK behavior into explanation, implementation, evidence handling, validation, and defensive operations. Relevance is generated from explicit identifiers/names and governed topic mappings; it is not attribution evidence.
Linux and macOS endpoint forensics
Digital Forensics & Incident Response (DFIR) · Tactic learning route · 24/100Policy architecture, standards, procedures, and exceptions
Governance, Risk & Compliance (GRC) · Tactic learning route · 24/100Module 6 — Alert triage, investigation, and escalation
Blue Team & Defensive Security · Tactic learning route · 24/100
Digital Forensics & Incident Response (DFIR) · Tactic learning route · 24/100Policy architecture, standards, procedures, and exceptions
Governance, Risk & Compliance (GRC) · Tactic learning route · 24/100Module 6 — Alert triage, investigation, and escalation
Blue Team & Defensive Security · Tactic learning route · 24/100
MITRE mitigations
No ATT&CK mitigation relationship is published for this technique. Apply risk-based controls and verify scope.