Which SIEM platforms have a T1496.003 detection rule?

df00tech provides T1496.003 (SMS Pumping) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What data sources are required to detect SMS Pumping (T1496.003)?

Detecting SMS Pumping requires the following data sources: Application: Application Logs, Cloud Service: Cloud Service Modification, Network Traffic: Network Traffic Flow, Microsoft Azure Application Insights, Azure Communication Services Diagnostics.

What severity and confidence is the T1496.003 detection?

The T1496.003 detection is rated high severity with medium confidence.

What are common false positives for T1496.003?

Common false positives for T1496.003 include: Legitimate bulk SMS marketing or promotional campaigns sending high volume through the same Communication Services resource; Load testing or security testing of OTP endpoints by internal teams without prior SOC notification; A viral product launch or viral marketing event driving a legitimate spike in new-user OTP verification requests.

T1496.003 IBM QRadar · QRadar

Detect SMS Pumping in IBM QRadar

Adversaries may leverage messaging services for SMS pumping, a telecommunications fraud technique where the attacker first obtains a block of phone numbers from a carrier, then abuses a victim's SMS infrastructure to generate large volumes of messages to those numbers. The adversary earns per-message payments from the carrier proportional to traffic volume. Attack vectors typically target public-facing web forms — OTP verification, account confirmation, password reset — backed by services such as Twilio, AWS SNS, or Amazon Cognito. Indicators include a spike in SMS API calls from a small set of source IPs, sequential or numerically adjacent destination phone numbers, destination numbers concentrated in high-fraud carrier prefixes, and a sharp increase in SMS-related cloud spend. Unlike volumetric DoS, SMS pumping is financially motivated: the attacker profits directly from the victim's messaging bill.

MITRE ATT&CK

Tactic: Impact
Technique: T1496 Resource Hijacking
Sub-technique: T1496.003 SMS Pumping
Canonical reference: https://attack.mitre.org/techniques/T1496/003/

QRadar Detection Query

IBM QRadar (QRadar)

sql

SELECT
  DATEFORMAT(starttime, 'yyyy-MM-dd HH:mm') AS TimeWindow,
  sourceip AS SourceIP,
  LOGSOURCENAME(logsourceid) AS LogSource,
  QIDNAME(qid) AS EventName,
  COUNT(*) AS RequestCount,
  COUNT(DISTINCT username) AS UniqueUsers,
  CATEGORYNAME(category) AS Category
FROM events
WHERE
  starttime > (NOW() - 3600000)
  AND (
    QIDNAME(qid) ILIKE '%SNS%Publish%'
    OR QIDNAME(qid) ILIKE '%SmsSend%'
    OR QIDNAME(qid) ILIKE '%SmsDelivery%'
    OR QIDNAME(qid) ILIKE '%GetUserAttributeVerificationCode%'
    OR QIDNAME(qid) ILIKE '%ResendConfirmationCode%'
    OR QIDNAME(qid) ILIKE '%ForgotPassword%'
    OR QIDNAME(qid) ILIKE '%InitiateAuth%'
    OR UTF8(payload) ILIKE '%"phoneNumber"%'
    OR UTF8(payload) ILIKE '%"phone_number"%'
    OR (
      CATEGORYNAME(category) ILIKE '%Authentication%'
      AND UTF8(payload) ILIKE '%otp%'
    )
    OR (
      CATEGORYNAME(category) ILIKE '%Web%'
      AND (
        UTF8(payload) ILIKE '%/otp%'
        OR UTF8(payload) ILIKE '%/verify%'
        OR UTF8(payload) ILIKE '%/2fa%'
        OR UTF8(payload) ILIKE '%/mfa%'
        OR UTF8(payload) ILIKE '%send-code%'
        OR UTF8(payload) ILIKE '%send_code%'
      )
    )
  )
GROUP BY
  DATEFORMAT(starttime, 'yyyy-MM-dd HH:mm'),
  sourceip,
  LOGSOURCENAME(logsourceid),
  QIDNAME(qid),
  CATEGORYNAME(category)
HAVING COUNT(*) > 50
ORDER BY RequestCount DESC
LAST 1 HOURS

high severity medium confidence

Detects T1496.003 SMS Pumping in IBM QRadar SIEM by aggregating cloud API events (AWS SNS Publish, Cognito OTP calls, Azure Communication Services) and web application events whose raw payload contains OTP or phone number field patterns. Groups by 1-minute time windows and source IP, flagging sources exceeding 50 matching events in the past hour. Accuracy depends on the quality of QID mappings configured in your DSM/QID map for the relevant log sources. Tune the HAVING threshold against your environment's baseline SMS volume to reduce false positives from legitimate bulk messaging workloads.

Data Sources

AWS CloudTrail via QRadar AWS CloudTrail DSMAzure Diagnostics via QRadar Microsoft Azure DSMWeb Application Firewall logs via QRadar Custom DSM or supported WAF DSMApplication server syslog or JSON logs normalized via Custom Log Source ExtensionTwilio event webhooks forwarded to QRadar via syslog or HTTP receiver

Required Tables

events

False Positives & Tuning

Bulk SMS marketing platforms (e.g., Klaviyo, Attentive) that route high-volume promotional message sends through a shared API gateway IP will breach the per-IP threshold even though the traffic is legitimate — create a whitelist offense rule suppression for known marketing automation source IPs
Multi-tenant SaaS applications where all customer traffic egresses through a shared NAT IP, causing legitimate aggregate OTP volumes from many customers to appear as a single high-rate source
Poorly configured application retry logic that resends OTP requests aggressively on transient failures (e.g., retrying 10 times per user within seconds), generating disproportionately high event counts from a single service IP
Disaster recovery drills or business continuity tests that exercise OTP and MFA flows for large employee populations simultaneously, creating a short-duration spike that triggers the threshold

Download portable Sigma rule (.yml)

Other platforms for T1496.003

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

Test 1AWS SNS Publish Burst to Phone Number via CLI
Expected signal: AWS CloudTrail: 15 eventName=Publish events from eventSource=sns.amazonaws.com within ~5 seconds, each with requestParameters containing phoneNumber=+15550001234 and message content. Events appear in CloudTrail within ~15 minutes. SNS CloudWatch metric NumberOfMessagesSentToPhoneNumbers increments by 15. SMSMonthToDateSpentUSD increases.
Test 2Amazon Cognito ForgotPassword OTP Flood
Expected signal: AWS CloudTrail: up to 20 eventName=ForgotPassword events from eventSource=cognito-idp.amazonaws.com within ~10 seconds, all sharing the same sourceIPAddress. requestParameters.username will be consistent across all events. Cognito may throttle after ~5 rapid requests, generating ThrottlingException errors also visible in CloudTrail.
Test 3OTP Form Endpoint Burst via curl Parallel Requests
Expected signal: Application Insights AppRequests table: 60 request entries for /api/auth/send-otp with identical ClientIP (local machine), ResultCode 200 or 429 (rate-limited), arriving within a ~15-second window. Telemetry visible in Application Insights within 1-2 minutes. If Application Insights SDK is not instrumented in the local app, substitute with reviewing the application access log.
Test 4Twilio REST API SMS Burst
Expected signal: Twilio Console: 5 outbound messages visible under Monitor > Logs > Messaging Logs within seconds. Twilio REST API: GET /2010-04-01/Accounts/{AccountSid}/Messages.json returns 5 records with Direction=outbound-api, Status=delivered or sent. Twilio usage record increments SMSSent by 5. NOTE: Direct Twilio API calls do NOT generate AWS CloudTrail or Azure Diagnostic events — detection requires Twilio Event Streams ingested into SIEM or Twilio's native fraud scoring dashboard.

Last updated: 2026-04-13 Research depth: deep

References (10)

Response Playbook

1. Examine the full command line and decode any Base64 content...
2. Identify the parent process chain and user context...
3. Check for concurrent network connections from the process...

Investigation Guide

Related techniques: T1027, T1105, T1562.001...
Forensic artifacts: PSReadLine history, Prefetch, ScriptBlock logs...

Atomic Red Team Tests

Test 1: Encoded command execution...
Test 2: Download cradle via Net.WebClient...

Unlock Pro Content

Get the full detection package for T1496.003 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance

Detect SMS Pumping in IBM QRadar

MITRE ATT&CK

QRadar Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for T1496.003

Testing Methodology

Response Playbook

Investigation Guide

Atomic Red Team Tests

Unlock Pro Content

Related Detections

Parent Technique

Related Sub-techniques

Related Techniques

Same Tactic: Impact

Popular Detections

MITRE ATT&CK

QRadar Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for T1496.003

Testing Methodology

Unlock Pro Content

Related Detections

Parent Technique

Related Sub-techniques

Related Techniques

Same Tactic: Impact

Popular Detections

Get new detections in your inbox