Which SIEM platforms have a T1496.003 detection rule?

df00tech provides T1496.003 (SMS Pumping) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What data sources are required to detect SMS Pumping (T1496.003)?

Detecting SMS Pumping requires the following data sources: Application: Application Logs, Cloud Service: Cloud Service Modification, Network Traffic: Network Traffic Flow, Microsoft Azure Application Insights, Azure Communication Services Diagnostics.

What severity and confidence is the T1496.003 detection?

The T1496.003 detection is rated high severity with medium confidence.

What are common false positives for T1496.003?

Common false positives for T1496.003 include: Legitimate bulk SMS marketing or promotional campaigns sending high volume through the same Communication Services resource; Load testing or security testing of OTP endpoints by internal teams without prior SOC notification; A viral product launch or viral marketing event driving a legitimate spike in new-user OTP verification requests.

T1496.003 Sumo Logic CSE · Sumo

Detect SMS Pumping in Sumo Logic CSE

Adversaries may leverage messaging services for SMS pumping, a telecommunications fraud technique where the attacker first obtains a block of phone numbers from a carrier, then abuses a victim's SMS infrastructure to generate large volumes of messages to those numbers. The adversary earns per-message payments from the carrier proportional to traffic volume. Attack vectors typically target public-facing web forms — OTP verification, account confirmation, password reset — backed by services such as Twilio, AWS SNS, or Amazon Cognito. Indicators include a spike in SMS API calls from a small set of source IPs, sequential or numerically adjacent destination phone numbers, destination numbers concentrated in high-fraud carrier prefixes, and a sharp increase in SMS-related cloud spend. Unlike volumetric DoS, SMS pumping is financially motivated: the attacker profits directly from the victim's messaging bill.

MITRE ATT&CK

Tactic: Impact
Technique: T1496 Resource Hijacking
Sub-technique: T1496.003 SMS Pumping
Canonical reference: https://attack.mitre.org/techniques/T1496/003/

Sumo Detection Query

Sumo Logic CSE (Sumo)

sql

_index=sec_record
| where metadata_vendor in ("Amazon Web Services", "Microsoft Azure", "Twilio", "Vonage", "Plivo")
  or metadata_product in ("CloudTrail", "AzureDiagnostics", "SNS", "Cognito")
| where (
    action in (
      "Publish", "GetUserAttributeVerificationCode",
      "ResendConfirmationCode", "ForgotPassword",
      "InitiateAuth", "SmsSend", "SmsDelivery"
    )
    or http_url matches /(otp|verify|verification|confirm|sms|phone|mobile|2fa|mfa|passcode|send[-_]code)/i
  )
| where isNull(http_response_statusCode)
  or http_response_statusCode in ("200", "400", "422", "429")
| timeslice 5m
| count by _timeslice, srcDevice_ip, action, metadata_vendor
| where _count > 50
| sort by _count desc
| fields
    _timeslice as TimeWindow,
    srcDevice_ip as SourceIP,
    action as EventAction,
    metadata_vendor as Vendor,
    _count as RequestCount

high severity medium confidence

Detects T1496.003 SMS Pumping in Sumo Logic Cloud SIEM Enterprise using the normalized sec_record index. Queries CSE records from cloud providers (AWS, Azure) and SMS platform vendors, filtering on normalized action fields matching cloud SMS API operations and HTTP URL patterns matching OTP/phone-verification path components. Groups by source device IP in 5-minute buckets and alerts when any source exceeds 50 matching events. Uses CSE normalized schema fields (srcDevice_ip, action, http_url, http_response_statusCode, metadata_vendor, metadata_product) enabling cross-vendor correlation without vendor-specific parsers.

Data Sources

AWS CloudTrail via Sumo Logic AWS CloudTrail App or HTTP sourceAzure Diagnostics via Sumo Logic Azure Monitor Logs integrationTwilio or Vonage event webhooks forwarded to a Sumo Logic HTTP sourceWeb application access logs normalized to CSE via a Sumo Logic log mapper

Required Tables

_index=sec_record (Sumo Logic Cloud SIEM Enterprise normalized events index)

False Positives & Tuning

Corporate NAT or cloud egress gateways that aggregate legitimate employee OTP requests from many internal users, causing the shared source IP to exceed per-IP thresholds even though individual user behavior is normal — segment by department or subnet if possible
CI/CD pipeline runners with static IPs executing end-to-end phone verification integration tests against production or staging environments as part of nightly test suites
Legitimate bulk SMS service resellers or ISVs whose outbound traffic is ingested into the same SIEM tenant and whose normal operating volume surpasses the detection threshold
Rapid customer onboarding waves (e.g., post-marketing event) where a genuine burst of new user registrations requiring phone verification occurs within a short window, creating a natural spike that mirrors the attack pattern

Download portable Sigma rule (.yml)

Other platforms for T1496.003

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

Test 1AWS SNS Publish Burst to Phone Number via CLI
Expected signal: AWS CloudTrail: 15 eventName=Publish events from eventSource=sns.amazonaws.com within ~5 seconds, each with requestParameters containing phoneNumber=+15550001234 and message content. Events appear in CloudTrail within ~15 minutes. SNS CloudWatch metric NumberOfMessagesSentToPhoneNumbers increments by 15. SMSMonthToDateSpentUSD increases.
Test 2Amazon Cognito ForgotPassword OTP Flood
Expected signal: AWS CloudTrail: up to 20 eventName=ForgotPassword events from eventSource=cognito-idp.amazonaws.com within ~10 seconds, all sharing the same sourceIPAddress. requestParameters.username will be consistent across all events. Cognito may throttle after ~5 rapid requests, generating ThrottlingException errors also visible in CloudTrail.
Test 3OTP Form Endpoint Burst via curl Parallel Requests
Expected signal: Application Insights AppRequests table: 60 request entries for /api/auth/send-otp with identical ClientIP (local machine), ResultCode 200 or 429 (rate-limited), arriving within a ~15-second window. Telemetry visible in Application Insights within 1-2 minutes. If Application Insights SDK is not instrumented in the local app, substitute with reviewing the application access log.
Test 4Twilio REST API SMS Burst
Expected signal: Twilio Console: 5 outbound messages visible under Monitor > Logs > Messaging Logs within seconds. Twilio REST API: GET /2010-04-01/Accounts/{AccountSid}/Messages.json returns 5 records with Direction=outbound-api, Status=delivered or sent. Twilio usage record increments SMSSent by 5. NOTE: Direct Twilio API calls do NOT generate AWS CloudTrail or Azure Diagnostic events — detection requires Twilio Event Streams ingested into SIEM or Twilio's native fraud scoring dashboard.

Last updated: 2026-04-13 Research depth: deep

References (10)

Response Playbook

1. Examine the full command line and decode any Base64 content...
2. Identify the parent process chain and user context...
3. Check for concurrent network connections from the process...

Investigation Guide

Related techniques: T1027, T1105, T1562.001...
Forensic artifacts: PSReadLine history, Prefetch, ScriptBlock logs...

Atomic Red Team Tests

Test 1: Encoded command execution...
Test 2: Download cradle via Net.WebClient...

Unlock Pro Content

Get the full detection package for T1496.003 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance

Detect SMS Pumping in Sumo Logic CSE

MITRE ATT&CK

Sumo Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for T1496.003

Testing Methodology

Response Playbook

Investigation Guide

Atomic Red Team Tests

Unlock Pro Content

Related Detections

Parent Technique

Related Sub-techniques

Related Techniques

Same Tactic: Impact

Popular Detections

MITRE ATT&CK

Sumo Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for T1496.003

Testing Methodology

Unlock Pro Content

Related Detections

Parent Technique

Related Sub-techniques

Related Techniques

Same Tactic: Impact

Popular Detections

Get new detections in your inbox