Use Case: Cryptomining

December 5, 2023 · View on GitHub

Use Case: Cryptomining

Vendor: APC

Product	MITRE ATT&CK® TTP	Content
APC	T1071.001 - Application Layer Protocol: Web Protocols T1496 - Resource Hijacking	1 Rules

Vendor: Absolute

Product	MITRE ATT&CK® TTP	Content
Absolute DDS	T1496 - Resource Hijacking	1 Rules

Vendor: Akamai

Product	MITRE ATT&CK® TTP	Content
Cloud Akamai	T1071.001 - Application Layer Protocol: Web Protocols T1496 - Resource Hijacking	1 Rules

Vendor: Amazon

Product	MITRE ATT&CK® TTP	Content
AWS CloudTrail	T1074 - Data Staged T1496 - Resource Hijacking	2 Rules 1 Models
AWS GuardDuty	T1071.001 - Application Layer Protocol: Web Protocols T1496 - Resource Hijacking	1 Rules
AWS WAF	T1071.001 - Application Layer Protocol: Web Protocols T1496 - Resource Hijacking	1 Rules
Amazon EKS	T1496 - Resource Hijacking	1 Rules
Amazon RDS	T1496 - Resource Hijacking	1 Rules

Vendor: Apache

Product	MITRE ATT&CK® TTP	Content
Apache	T1071.001 - Application Layer Protocol: Web Protocols T1496 - Resource Hijacking	1 Rules

Vendor: BeyondTrust

Product	MITRE ATT&CK® TTP	Content
BeyondInsight	T1496 - Resource Hijacking	1 Rules
BeyondTrust	T1496 - Resource Hijacking	1 Rules

Vendor: Check Point

Product	MITRE ATT&CK® TTP	Content
Check Point NGFW	T1071.001 - Application Layer Protocol: Web Protocols T1496 - Resource Hijacking	1 Rules

Vendor: Cisco

Product	MITRE ATT&CK® TTP	Content
Cisco ACS	T1496 - Resource Hijacking	1 Rules
Cisco Adaptive Security Appliance	T1071.001 - Application Layer Protocol: Web Protocols T1496 - Resource Hijacking	2 Rules
Cisco Cloud Web Security	T1071.001 - Application Layer Protocol: Web Protocols T1496 - Resource Hijacking	1 Rules
Cisco Firepower	T1071.001 - Application Layer Protocol: Web Protocols T1496 - Resource Hijacking	2 Rules
Cisco IOS	T1071.001 - Application Layer Protocol: Web Protocols T1496 - Resource Hijacking	2 Rules
Cisco Meraki MX appliance	T1071.001 - Application Layer Protocol: Web Protocols T1496 - Resource Hijacking	1 Rules
Cisco Secure Web Appliance	T1071.001 - Application Layer Protocol: Web Protocols T1496 - Resource Hijacking	1 Rules
Cisco Umbrella	T1071.001 - Application Layer Protocol: Web Protocols T1496 - Resource Hijacking	1 Rules
Duo Access	T1071.001 - Application Layer Protocol: Web Protocols T1496 - Resource Hijacking	1 Rules

Vendor: Citrix

Product	MITRE ATT&CK® TTP	Content
Citrix Gateway	T1496 - Resource Hijacking	1 Rules
Citrix Web App Firewall	T1071.001 - Application Layer Protocol: Web Protocols T1496 - Resource Hijacking	1 Rules

Vendor: Cloudflare

Product	MITRE ATT&CK® TTP	Content
Cloudflare WAF	T1071.001 - Application Layer Protocol: Web Protocols T1496 - Resource Hijacking	1 Rules

Vendor: Cohesity

Product	MITRE ATT&CK® TTP	Content
Cohesity DataPlatform	T1496 - Resource Hijacking	1 Rules

Vendor: CrowdStrike

Product	MITRE ATT&CK® TTP	Content
Falcon	T1496 - Resource Hijacking	1 Rules

Vendor: CyberArk

Product	MITRE ATT&CK® TTP	Content
CyberArk Privilege Access Manager	T1071.001 - Application Layer Protocol: Web Protocols T1496 - Resource Hijacking	1 Rules

Vendor: Delinea

Product	MITRE ATT&CK® TTP	Content
Centrify Infrastructure Services	T1496 - Resource Hijacking	1 Rules

Vendor: Dell

Product	MITRE ATT&CK® TTP	Content
Sonicwall	T1071.001 - Application Layer Protocol: Web Protocols T1496 - Resource Hijacking	1 Rules

Vendor: Digital Guardian

Product	MITRE ATT&CK® TTP	Content
Digital Guardian Endpoint Protection	T1496 - Resource Hijacking	1 Rules

Vendor: Dtex Systems

Product	MITRE ATT&CK® TTP	Content
DTEX InTERCEPT	T1071.001 - Application Layer Protocol: Web Protocols T1496 - Resource Hijacking	2 Rules

Vendor: Envoy

Product	MITRE ATT&CK® TTP	Content
Envoy	T1071.001 - Application Layer Protocol: Web Protocols T1496 - Resource Hijacking	1 Rules

Vendor: Extreme Networks

Product	MITRE ATT&CK® TTP	Content
ExtremeCloud IQ	T1071.001 - Application Layer Protocol: Web Protocols T1496 - Resource Hijacking	1 Rules

Vendor: F5

Product	MITRE ATT&CK® TTP	Content
F5 Advanced Web Application Firewall	T1496 - Resource Hijacking	1 Rules

Vendor: Forcepoint

Product	MITRE ATT&CK® TTP	Content
Forcepoint CASB	T1071.001 - Application Layer Protocol: Web Protocols T1496 - Resource Hijacking	1 Rules
Websense Security Gateway	T1071.001 - Application Layer Protocol: Web Protocols T1496 - Resource Hijacking	1 Rules

Vendor: Fortinet

Product	MITRE ATT&CK® TTP	Content
FortiGate	T1071.001 - Application Layer Protocol: Web Protocols T1496 - Resource Hijacking	1 Rules
Fortinet UTM	T1071.001 - Application Layer Protocol: Web Protocols T1496 - Resource Hijacking	1 Rules
Fortiweb Web Application Firewall	T1071.001 - Application Layer Protocol: Web Protocols T1496 - Resource Hijacking	1 Rules

Vendor: Gigamon

Product	MITRE ATT&CK® TTP	Content
GigaVUE-HC2	T1071.001 - Application Layer Protocol: Web Protocols T1496 - Resource Hijacking	1 Rules

Vendor: Google

Product	MITRE ATT&CK® TTP	Content
Google Cloud Platform	T1071.001 - Application Layer Protocol: Web Protocols T1074 - Data Staged T1496 - Resource Hijacking	2 Rules 1 Models
Google Workspace	T1071.001 - Application Layer Protocol: Web Protocols T1496 - Resource Hijacking	1 Rules

Vendor: HP

Product	MITRE ATT&CK® TTP	Content
HP iLO	T1071.001 - Application Layer Protocol: Web Protocols T1496 - Resource Hijacking	1 Rules
HPE Comware	T1496 - Resource Hijacking	1 Rules

Vendor: HelpSystems

Product	MITRE ATT&CK® TTP	Content
Powertech Identity and Access Manager	T1496 - Resource Hijacking	1 Rules

Vendor: Huawei

Product	MITRE ATT&CK® TTP	Content
Huawei Unified Security Gateway	T1496 - Resource Hijacking	1 Rules

Vendor: IBM

Product	MITRE ATT&CK® TTP	Content
IBM Mainframe	T1496 - Resource Hijacking	1 Rules

Vendor: Imperva

Product	MITRE ATT&CK® TTP	Content
Imperva Incapsula	T1071.001 - Application Layer Protocol: Web Protocols T1496 - Resource Hijacking	1 Rules

Vendor: InfoWatch

Product	MITRE ATT&CK® TTP	Content
InfoWatch DLP	T1071.001 - Application Layer Protocol: Web Protocols T1496 - Resource Hijacking	1 Rules

Vendor: Infoblox

Product	MITRE ATT&CK® TTP	Content
BloxOne DDI	T1496 - Resource Hijacking	1 Rules

Vendor: Ivanti

Product	MITRE ATT&CK® TTP	Content
Ivanti Pulse Secure	T1071.001 - Application Layer Protocol: Web Protocols T1496 - Resource Hijacking	1 Rules

Vendor: Juniper Networks

Product	MITRE ATT&CK® TTP	Content
Junos OS	T1071.001 - Application Layer Protocol: Web Protocols T1496 - Resource Hijacking	2 Rules

Vendor: Kasada

Product	MITRE ATT&CK® TTP	Content
Kasada	T1071.001 - Application Layer Protocol: Web Protocols T1496 - Resource Hijacking	1 Rules

Vendor: LanScope

Product	MITRE ATT&CK® TTP	Content
LanScope Cat	T1071.001 - Application Layer Protocol: Web Protocols T1496 - Resource Hijacking	2 Rules

Vendor: McAfee

Product	MITRE ATT&CK® TTP	Content
McAfee Web Gateway	T1071.001 - Application Layer Protocol: Web Protocols T1496 - Resource Hijacking	1 Rules

Vendor: Microsoft

Product	MITRE ATT&CK® TTP	Content
Active Directory Federation Services	T1071.001 - Application Layer Protocol: Web Protocols T1496 - Resource Hijacking	1 Rules
Azure Monitor	T1496 - Resource Hijacking	1 Rules 1 Models
Azure Monitor - VM Insights	T1496 - Resource Hijacking	1 Rules
Event Viewer - ADFS	T1071.001 - Application Layer Protocol: Web Protocols T1496 - Resource Hijacking	1 Rules
Event Viewer - DNSServer	T1496 - Resource Hijacking	1 Rules
Event Viewer - PowerShell	T1496 - Resource Hijacking	1 Rules
Event Viewer - Security	T1071.001 - Application Layer Protocol: Web Protocols T1496 - Resource Hijacking	2 Rules
Event Viewer - System	T1071.001 - Application Layer Protocol: Web Protocols T1496 - Resource Hijacking	2 Rules
Microsoft 365	T1496 - Resource Hijacking	1 Rules
Microsoft Defender for Endpoint	T1496 - Resource Hijacking	1 Rules
Microsoft Exchange	T1071.001 - Application Layer Protocol: Web Protocols T1496 - Resource Hijacking	1 Rules
Microsoft IIS	T1071.001 - Application Layer Protocol: Web Protocols T1496 - Resource Hijacking	1 Rules
Microsoft WMI Log	T1496 - Resource Hijacking	1 Rules
Sysmon	T1496 - Resource Hijacking	1 Rules

Vendor: Mimecast

Product	MITRE ATT&CK® TTP	Content
Mimecast Targeted Threat Protection - URL	T1071.001 - Application Layer Protocol: Web Protocols T1496 - Resource Hijacking	1 Rules

Vendor: Netskope

Product	MITRE ATT&CK® TTP	Content
Netskope Security Cloud	T1071.001 - Application Layer Protocol: Web Protocols T1496 - Resource Hijacking	1 Rules

Vendor: NextDLP

Product	MITRE ATT&CK® TTP	Content
Reveal	T1071.001 - Application Layer Protocol: Web Protocols T1496 - Resource Hijacking	1 Rules

Vendor: Okta

Product	MITRE ATT&CK® TTP	Content
Okta Adaptive MFA	T1071.001 - Application Layer Protocol: Web Protocols T1496 - Resource Hijacking	1 Rules

Vendor: OneWelcome

Product	MITRE ATT&CK® TTP	Content
OneWelcome Cloud Identity Platform	T1496 - Resource Hijacking	1 Rules

Vendor: Palo Alto Networks

Product	MITRE ATT&CK® TTP	Content
Cortex XSOAR	T1071.001 - Application Layer Protocol: Web Protocols T1496 - Resource Hijacking	1 Rules
GlobalProtect	T1071.001 - Application Layer Protocol: Web Protocols T1496 - Resource Hijacking	1 Rules
Palo Alto NGFW	T1071.001 - Application Layer Protocol: Web Protocols T1496 - Resource Hijacking	1 Rules
Prisma Cloud	T1071.001 - Application Layer Protocol: Web Protocols T1496 - Resource Hijacking	1 Rules

Vendor: Password Manager Pro

Product	MITRE ATT&CK® TTP	Content
Password Manager Pro	T1071.001 - Application Layer Protocol: Web Protocols T1496 - Resource Hijacking	1 Rules

Vendor: Proofpoint

Product	MITRE ATT&CK® TTP	Content
ObserveIT	T1496 - Resource Hijacking	1 Rules

Vendor: SIGSCI

Product	MITRE ATT&CK® TTP	Content
SIGSCI	T1071.001 - Application Layer Protocol: Web Protocols T1496 - Resource Hijacking	1 Rules

Vendor: SentinelOne

Product	MITRE ATT&CK® TTP	Content
Singularity Platform	T1071.001 - Application Layer Protocol: Web Protocols T1496 - Resource Hijacking	2 Rules

Vendor: SkySea

Product	MITRE ATT&CK® TTP	Content
SkySea ClientView	T1071.001 - Application Layer Protocol: Web Protocols T1496 - Resource Hijacking	2 Rules

Vendor: Skyhigh Security

Product	MITRE ATT&CK® TTP	Content
Skyhigh Security Cloud	T1071.001 - Application Layer Protocol: Web Protocols T1496 - Resource Hijacking	1 Rules

Vendor: Sophos

Product	MITRE ATT&CK® TTP	Content
Sophos UTM	T1071.001 - Application Layer Protocol: Web Protocols T1496 - Resource Hijacking	1 Rules

Vendor: Squid

Product	MITRE ATT&CK® TTP	Content
Squid	T1071.001 - Application Layer Protocol: Web Protocols T1496 - Resource Hijacking	1 Rules

Vendor: Symantec

Product	MITRE ATT&CK® TTP	Content
Symantec Advanced Threat Protection	T1496 - Resource Hijacking	1 Rules
Symantec Web Security Service	T1071.001 - Application Layer Protocol: Web Protocols T1496 - Resource Hijacking	1 Rules

Vendor: Tanium

Product	MITRE ATT&CK® TTP	Content
Tanium Core Platform	T1496 - Resource Hijacking	1 Rules
Tanium Integrity Monitor	T1496 - Resource Hijacking	1 Rules

Vendor: Trend Micro

Product	MITRE ATT&CK® TTP	Content
OfficeScan	T1071.001 - Application Layer Protocol: Web Protocols T1496 - Resource Hijacking	1 Rules

Vendor: Unix

Product	MITRE ATT&CK® TTP	Content
Auditbeat	T1496 - Resource Hijacking	1 Rules
Unix	T1496 - Resource Hijacking	1 Rules
Unix Auditd	T1496 - Resource Hijacking	1 Rules

Vendor: VMware

Product	MITRE ATT&CK® TTP	Content
Carbon Black App Control	T1496 - Resource Hijacking	1 Rules
Carbon Black CES	T1496 - Resource Hijacking	1 Rules
Carbon Black EDR	T1496 - Resource Hijacking	1 Rules

Vendor: Varonis

Product	MITRE ATT&CK® TTP	Content
Varonis Data Security Platform	T1071.001 - Application Layer Protocol: Web Protocols T1496 - Resource Hijacking	1 Rules

Vendor: Vectra

Product	MITRE ATT&CK® TTP	Content
Vectra Cognito Stream	T1071.001 - Application Layer Protocol: Web Protocols T1496 - Resource Hijacking	1 Rules

Vendor: Zeek

Product	MITRE ATT&CK® TTP	Content
Zeek	T1071.001 - Application Layer Protocol: Web Protocols T1496 - Resource Hijacking	1 Rules

Vendor: Zscaler

Product	MITRE ATT&CK® TTP	Content
Zscaler Internet Access	T1071.001 - Application Layer Protocol: Web Protocols T1496 - Resource Hijacking	1 Rules

Vendor:

Product	MITRE ATT&CK® TTP	Content
	T1071.001 - Application Layer Protocol: Web Protocols T1496 - Resource Hijacking	2 Rules