Which SIEM platforms have a T1496.004 detection rule?

df00tech provides T1496.004 (Cloud Service Hijacking) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What data sources are required to detect Cloud Service Hijacking (T1496.004)?

Detecting Cloud Service Hijacking requires the following data sources: Cloud Service: Cloud Service Enumeration, Cloud Service: Cloud Service Modification, Application Log: Application Log Content, AWS CloudTrail.

What severity and confidence is the T1496.004 detection?

The T1496.004 detection is rated high severity with medium confidence.

What are common false positives for T1496.004?

Common false positives for T1496.004 include: Legitimate email marketing campaigns using AWS SES with high send volumes for newsletters, product launches, or promotional blasts — verify against scheduled marketing activities in change management systems; Application notification services sending high volumes of transactional emails via SES for password resets, order confirmations, or system alerts during peak traffic periods; Legitimate ML/AI production workloads running batch inference via AWS Bedrock for model evaluation pipelines, A/B testing, or high-throughput production inference services.

T1496.004 IBM QRadar · QRadar

Detect Cloud Service Hijacking in IBM QRadar

Adversaries may leverage compromised software-as-a-service (SaaS) applications to complete resource-intensive tasks, impacting hosted service availability and incurring significant financial costs for victims. Primary attack vectors include: (1) Email/SMS spam campaigns abusing AWS Simple Email Service (SES), AWS Simple Notification Service (SNS), SendGrid, and Twilio to send bulk phishing or spam messages using the victim's service quotas and sending reputation; (2) LLMJacking, where adversaries use stolen cloud credentials to proxy AI model inference requests (AWS Bedrock, Azure OpenAI) through reverse proxies, effectively monetizing access to expensive LLM compute while billing the victim; (3) Enabling previously inactive cloud SaaS services and immediately exploiting them at scale. Threat actor DangerDev (documented by Invictus IR) abused AWS SES for large-scale phishing campaigns, SNS Sender toolkits (documented by SentinelOne) enable SMS pumping at scale, and LLMJacking campaigns (documented by Sysdig and Lacework) demonstrate adversaries reselling stolen LLM API access.

MITRE ATT&CK

Tactic: Impact
Technique: T1496 Resource Hijacking
Sub-technique: T1496.004 Cloud Service Hijacking
Canonical reference: https://attack.mitre.org/techniques/T1496/004/

QRadar Detection Query

IBM QRadar (QRadar)

sql

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:00:00') AS TimeBucket,
  "EventSource" AS ServiceAbused,
  CASE
    WHEN "EventSource" = 'ses.amazonaws.com' THEN 'Email Spam or Phishing Campaign'
    WHEN "EventSource" = 'sns.amazonaws.com' THEN 'SMS Pumping or Bulk Spam'
    WHEN "EventSource" = 'bedrock.amazonaws.com' THEN 'LLM Resource Hijacking (LLMJacking)'
    ELSE 'SaaS Service Abuse'
  END AS AttackCategory,
  "UserIdentityArn" AS CallerARN,
  "UserIdentityType" AS CallerType,
  sourceip AS SourceIP,
  "AWSRegion",
  COUNT(*) AS EventCount,
  UNIQUECOUNT(sourceip) AS UniqueSourceIPs,
  CASE
    WHEN "EventSource" = 'ses.amazonaws.com' THEN 100
    WHEN "EventSource" = 'sns.amazonaws.com' THEN 200
    WHEN "EventSource" = 'bedrock.amazonaws.com' THEN 50
    ELSE 50
  END AS ServiceThreshold,
  CASE
    WHEN COUNT(*) > (CASE WHEN "EventSource" = 'ses.amazonaws.com' THEN 1000 WHEN "EventSource" = 'sns.amazonaws.com' THEN 2000 ELSE 500 END) THEN 3
    WHEN COUNT(*) > (CASE WHEN "EventSource" = 'ses.amazonaws.com' THEN 300 WHEN "EventSource" = 'sns.amazonaws.com' THEN 600 ELSE 150 END) THEN 2
    ELSE 1
  END AS SuspicionScore
FROM events
WHERE LOGSOURCETYPENAME(devicetype) = 'Amazon AWS CloudTrail'
  AND starttime > NOW() - 86400000
  AND "EventSource" IN ('ses.amazonaws.com', 'sns.amazonaws.com', 'bedrock.amazonaws.com')
  AND "EventName" IN (
    'SendEmail', 'SendRawEmail', 'SendBulkTemplatedEmail', 'SendBulkEmail', 'SendTemplatedEmail',
    'Publish', 'PublishBatch',
    'InvokeModel', 'InvokeModelWithResponseStream', 'CreateModelInvocationJob', 'InvokeAgent'
  )
  AND ("ErrorCode" IS NULL OR "ErrorCode" = '')
GROUP BY
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:00:00'),
  "EventSource",
  "UserIdentityArn",
  "UserIdentityType",
  sourceip,
  "AWSRegion"
HAVING
  ("EventSource" = 'ses.amazonaws.com' AND COUNT(*) > 100) OR
  ("EventSource" = 'sns.amazonaws.com' AND COUNT(*) > 200) OR
  ("EventSource" = 'bedrock.amazonaws.com' AND COUNT(*) > 50)
ORDER BY SuspicionScore DESC, EventCount DESC
LAST 1 DAYS

high severity high confidence

Detects Cloud Service Hijacking (T1496.004) by aggregating successful AWS CloudTrail API calls to SES, SNS, and Bedrock per identity per hour and applying service-specific thresholds (SES >100, SNS >200, Bedrock >50). Uses QRadar's Amazon AWS CloudTrail DSM custom properties (EventSource, EventName, UserIdentityArn, UserIdentityType, ErrorCode, AWSRegion) alongside standard AQL fields. SuspicionScore escalates at 3x and 10x threshold multiples. HAVING clause applies per-service thresholds dynamically to reduce false positives. Requires AWS CloudTrail DSM to be installed and custom properties to be parsed from the JSON payload.

Data Sources

AWS CloudTrail

Required Tables

events (LOGSOURCETYPENAME = 'Amazon AWS CloudTrail')

False Positives & Tuning

High-volume transactional email systems (order confirmations, password resets) sending through SES can exceed 100/hr during peak traffic — create a QRadar reference set of known legitimate SES IAM ARNs and add an exclusion
SNS-based OTP or push notification systems for mobile apps generating burst traffic during marketing campaigns or user onboarding waves — correlate with application deployment events
Automated ML training pipelines invoking Bedrock for hyperparameter tuning or A/B test evaluation — these run as scheduled AssumedRole sessions and can be allowlisted by role ARN pattern

Download portable Sigma rule (.yml)

Other platforms for T1496.004

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

Test 1AWS SES High-Volume Email Sending Simulation
Expected signal: AWS CloudTrail: 10 events with EventName=SendEmail, EventSource=ses.amazonaws.com, originating from the caller IAM ARN and source IP. CloudWatch Metrics: SES NumberOfEmailsSent increments by 10. Sentinel AWSCloudTrail table: events appear within 5 minutes of AWS CloudTrail delivery delay.
Test 2AWS SNS SMS Publishing Burst with Promotional Configuration
Expected signal: AWS CloudTrail: SetSMSAttributes event (RequestParameters shows DefaultSMSType=Promotional), CreateTopic event with TopicName=argus-t1496004-test, and 5 x Publish events, all from the same IAM ARN within a short time window. CloudWatch: SNS NumberOfMessagesSent and SMSMonthToDateSpentUSD metrics increment.
Test 3AWS Bedrock LLM Invocation Burst (LLMJacking Simulation)
Expected signal: AWS CloudTrail: 15 x EventName=InvokeModel, EventSource=bedrock.amazonaws.com, with ModelId=amazon.titan-text-lite-v1 in RequestParameters, all from same IAM ARN and source IP. CloudWatch: Bedrock InvocationCount metric increments by 15. If Bedrock invocation logging is enabled, S3 or CloudWatch Logs capture input prompts and responses.
Test 4SES Service Enablement Then Immediate Abuse Pattern
Expected signal: AWS CloudTrail: CreateEmailIdentity event followed within seconds by SendEmail event (possibly ErrorCode=MessageRejected if unverified), then GetEmailIdentity event — all from same IAM ARN and source IP within a 1-2 minute window. The sub-minute gap between CreateEmailIdentity and SendEmail is the key forensic indicator.

Last updated: 2026-04-13 Research depth: deep

References (12)

Response Playbook

1. Examine the full command line and decode any Base64 content...
2. Identify the parent process chain and user context...
3. Check for concurrent network connections from the process...

Investigation Guide

Related techniques: T1027, T1105, T1562.001...
Forensic artifacts: PSReadLine history, Prefetch, ScriptBlock logs...

Atomic Red Team Tests

Test 1: Encoded command execution...
Test 2: Download cradle via Net.WebClient...

Unlock Pro Content

Get the full detection package for T1496.004 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance

Detect Cloud Service Hijacking in IBM QRadar

MITRE ATT&CK

QRadar Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for T1496.004

Testing Methodology

Response Playbook

Investigation Guide

Atomic Red Team Tests

Unlock Pro Content

Related Detections

Parent Technique

Related Sub-techniques

Related Techniques

Same Tactic: Impact

Popular Detections

MITRE ATT&CK

QRadar Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for T1496.004

Testing Methodology

Unlock Pro Content

Related Detections

Parent Technique

Related Sub-techniques

Related Techniques

Same Tactic: Impact

Popular Detections

Get new detections in your inbox