Detect Cloud Service Hijacking in Elastic Security
Adversaries may leverage compromised software-as-a-service (SaaS) applications to complete resource-intensive tasks, impacting hosted service availability and incurring significant financial costs for victims. Primary attack vectors include: (1) Email/SMS spam campaigns abusing AWS Simple Email Service (SES), AWS Simple Notification Service (SNS), SendGrid, and Twilio to send bulk phishing or spam messages using the victim's service quotas and sending reputation; (2) LLMJacking, where adversaries use stolen cloud credentials to proxy AI model inference requests (AWS Bedrock, Azure OpenAI) through reverse proxies, effectively monetizing access to expensive LLM compute while billing the victim; (3) Enabling previously inactive cloud SaaS services and immediately exploiting them at scale. Threat actor DangerDev (documented by Invictus IR) abused AWS SES for large-scale phishing campaigns, SNS Sender toolkits (documented by SentinelOne) enable SMS pumping at scale, and LLMJacking campaigns (documented by Sysdig and Lacework) demonstrate adversaries reselling stolen LLM API access.
MITRE ATT&CK
- Tactic
- Impact
- Technique
- T1496 Resource Hijacking
- Sub-technique
- T1496.004 Cloud Service Hijacking
- Canonical reference
- https://attack.mitre.org/techniques/T1496/004/
Elastic Detection Query
// Branch A: Service enablement immediately followed by high-volume abuse (DangerDev pattern)
sequence by aws.cloudtrail.user_identity.arn with maxspan=6h
[any where event.dataset == "aws.cloudtrail"
and event.action in (
"CreateEmailIdentity", "VerifyEmailIdentity", "PutIdentityPolicy",
"SetSMSAttributes", "CreateTopic",
"PutFoundationModelEntitlement", "CreateFoundationModelAgreement",
"PutModelInvocationLoggingConfiguration"
)
and (aws.cloudtrail.error_code == null or aws.cloudtrail.error_code == "")]
[any where event.dataset == "aws.cloudtrail"
and event.provider in ("ses.amazonaws.com", "sns.amazonaws.com", "bedrock.amazonaws.com")
and event.action in (
"SendEmail", "SendRawEmail", "SendBulkTemplatedEmail", "SendBulkEmail",
"Publish", "PublishBatch",
"InvokeModel", "InvokeModelWithResponseStream", "CreateModelInvocationJob"
)
and (aws.cloudtrail.error_code == null or aws.cloudtrail.error_code == "")] with runs=10
// Branch B: High-frequency SES abuse threshold (deploy as separate Elastic threshold rule: >100 matches/1h by aws.cloudtrail.user_identity.arn)
any where event.dataset == "aws.cloudtrail"
and event.provider == "ses.amazonaws.com"
and event.action in ("SendEmail", "SendRawEmail", "SendBulkTemplatedEmail", "SendBulkEmail", "SendTemplatedEmail")
and (aws.cloudtrail.error_code == null or aws.cloudtrail.error_code == "")
// Branch C: High-frequency SNS abuse threshold (deploy as separate Elastic threshold rule: >200 matches/1h by aws.cloudtrail.user_identity.arn)
any where event.dataset == "aws.cloudtrail"
and event.provider == "sns.amazonaws.com"
and event.action in ("Publish", "PublishBatch")
and (aws.cloudtrail.error_code == null or aws.cloudtrail.error_code == "")
// Branch D: LLMJacking threshold (deploy as separate Elastic threshold rule: >50 matches/1h by aws.cloudtrail.user_identity.arn)
any where event.dataset == "aws.cloudtrail"
and event.provider == "bedrock.amazonaws.com"
and event.action in ("InvokeModel", "InvokeModelWithResponseStream", "CreateModelInvocationJob", "InvokeAgent")
and (aws.cloudtrail.error_code == null or aws.cloudtrail.error_code == "")Detects Cloud Service Hijacking (T1496.004) across four branches: (1) AWS SaaS service enablement immediately followed by high-volume API use within 6h (DangerDev pattern — most precise, use EQL sequence rule type); (2) high-volume SES email sending >100/hr per identity (spam/phishing); (3) high-volume SNS publishing >200/hr per identity (SMS pumping); (4) high-frequency Bedrock LLM invocations >50/hr per identity (LLMJacking). Branches B-D should be deployed as Elastic threshold rule type with a 1h sliding window grouped by aws.cloudtrail.user_identity.arn. Uses Elastic AWS integration ECS field mappings: event.dataset, event.provider, event.action, aws.cloudtrail.user_identity.arn, aws.cloudtrail.error_code.
Data Sources
Required Tables
False Positives & Tuning
- Marketing automation platforms executing scheduled bulk email sends via SES for newsletters or promotional campaigns — validate against known marketing IAM roles and expected send windows
- CI/CD pipelines that provision cloud services and immediately run integration tests, triggering the service enablement + use sequence — baseline known pipeline ARNs and exclude them
- Data science teams running large-scale batch inference jobs on Bedrock for model evaluation or production batch scoring pipelines — correlate against change tickets and engineering schedules
Other platforms for T1496.004
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1AWS SES High-Volume Email Sending Simulation
Expected signal: AWS CloudTrail: 10 events with EventName=SendEmail, EventSource=ses.amazonaws.com, originating from the caller IAM ARN and source IP. CloudWatch Metrics: SES NumberOfEmailsSent increments by 10. Sentinel AWSCloudTrail table: events appear within 5 minutes of AWS CloudTrail delivery delay.
- Test 2AWS SNS SMS Publishing Burst with Promotional Configuration
Expected signal: AWS CloudTrail: SetSMSAttributes event (RequestParameters shows DefaultSMSType=Promotional), CreateTopic event with TopicName=argus-t1496004-test, and 5 x Publish events, all from the same IAM ARN within a short time window. CloudWatch: SNS NumberOfMessagesSent and SMSMonthToDateSpentUSD metrics increment.
- Test 3AWS Bedrock LLM Invocation Burst (LLMJacking Simulation)
Expected signal: AWS CloudTrail: 15 x EventName=InvokeModel, EventSource=bedrock.amazonaws.com, with ModelId=amazon.titan-text-lite-v1 in RequestParameters, all from same IAM ARN and source IP. CloudWatch: Bedrock InvocationCount metric increments by 15. If Bedrock invocation logging is enabled, S3 or CloudWatch Logs capture input prompts and responses.
- Test 4SES Service Enablement Then Immediate Abuse Pattern
Expected signal: AWS CloudTrail: CreateEmailIdentity event followed within seconds by SendEmail event (possibly ErrorCode=MessageRejected if unverified), then GetEmailIdentity event — all from same IAM ARN and source IP within a 1-2 minute window. The sub-minute gap between CreateEmailIdentity and SendEmail is the key forensic indicator.
References (12)
- https://attack.mitre.org/techniques/T1496/004/
- https://www.invictus-ir.com/news/the-curious-case-of-dangerdev-protonmail-me
- https://permiso.io/blog/s/aws-ses-pionage-detecting-ses-abuse/
- https://www.sentinelone.com/labs/sns-sender-active-campaigns-unleash-messaging-spam-through-the-cloud/
- https://sysdig.com/blog/llmjacking-stolen-cloud-credentials-used-in-new-ai-attack/
- https://www.lacework.com/blog/detecting-ai-resource-hijacking-with-composite-alerts
- https://docs.aws.amazon.com/ses/latest/dg/monitor-sending-activity.html
- https://docs.aws.amazon.com/sns/latest/dg/sms_stats_cloudwatch.html
- https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html
- https://docs.microsoft.com/en-us/azure/sentinel/connect-aws-cloudtrail
- https://docs.splunk.com/Documentation/AddOns/released/AWS/CloudTrail
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1496/T1496.md
Unlock Pro Content
Get the full detection package for T1496.004 including response playbook, investigation guide, and atomic red team tests.