Detect Cloud Service Hijacking in Splunk
Adversaries may leverage compromised software-as-a-service (SaaS) applications to complete resource-intensive tasks, impacting hosted service availability and incurring significant financial costs for victims. Primary attack vectors include: (1) Email/SMS spam campaigns abusing AWS Simple Email Service (SES), AWS Simple Notification Service (SNS), SendGrid, and Twilio to send bulk phishing or spam messages using the victim's service quotas and sending reputation; (2) LLMJacking, where adversaries use stolen cloud credentials to proxy AI model inference requests (AWS Bedrock, Azure OpenAI) through reverse proxies, effectively monetizing access to expensive LLM compute while billing the victim; (3) Enabling previously inactive cloud SaaS services and immediately exploiting them at scale. Threat actor DangerDev (documented by Invictus IR) abused AWS SES for large-scale phishing campaigns, SNS Sender toolkits (documented by SentinelOne) enable SMS pumping at scale, and LLMJacking campaigns (documented by Sysdig and Lacework) demonstrate adversaries reselling stolen LLM API access.
MITRE ATT&CK
- Tactic
- Impact
- Technique
- T1496 Resource Hijacking
- Sub-technique
- T1496.004 Cloud Service Hijacking
- Canonical reference
- https://attack.mitre.org/techniques/T1496/004/
SPL Detection Query
index=aws sourcetype="aws:cloudtrail"
(eventSource="ses.amazonaws.com" OR eventSource="sns.amazonaws.com" OR eventSource="bedrock.amazonaws.com")
(eventName="SendEmail" OR eventName="SendRawEmail" OR eventName="SendBulkTemplatedEmail" OR eventName="SendBulkEmail"
OR eventName="Publish" OR eventName="PublishBatch"
OR eventName="InvokeModel" OR eventName="InvokeModelWithResponseStream" OR eventName="CreateModelInvocationJob")
NOT errorCode=*
| eval ServiceAbused=case(
eventSource="ses.amazonaws.com", "AWS SES",
eventSource="sns.amazonaws.com", "AWS SNS",
eventSource="bedrock.amazonaws.com", "AWS Bedrock",
true(), "Unknown"
)
| eval AttackCategory=case(
ServiceAbused="AWS SES", "Email Spam or Phishing Campaign",
ServiceAbused="AWS SNS", "SMS Pumping or Bulk Spam",
ServiceAbused="AWS Bedrock", "LLM Resource Hijacking (LLMJacking)",
true(), "SaaS Service Abuse"
)
| eval CallerARN=coalesce('userIdentity.arn', 'userIdentity.principalId', "unknown")
| eval CallerType=coalesce('userIdentity.type', "unknown")
| bin _time span=1h
| stats count as EventCount,
dc(sourceIPAddress) as UniqueIPs,
values(sourceIPAddress) as SourceIPs,
earliest(_time) as FirstEvent,
latest(_time) as LastEvent
by _time, ServiceAbused, AttackCategory, CallerARN, CallerType, awsRegion
| eval Threshold=case(
ServiceAbused="AWS SES", 100,
ServiceAbused="AWS SNS", 200,
ServiceAbused="AWS Bedrock", 50,
true(), 50
)
| where EventCount > Threshold
| eval SuspicionScore=case(
EventCount > Threshold * 10, 3,
EventCount > Threshold * 3, 2,
true(), 1
)
| eval SuspicionScore=SuspicionScore + if(UniqueIPs > 3, 1, 0)
| eval SuspicionScore=SuspicionScore + if(CallerType="AssumedRole", 1, 0)
| eval SuspicionScore=SuspicionScore + if(match(CallerARN, "(temp|tmp|test|anon|random)"), 1, 0)
| sort - SuspicionScore, - EventCount
| table _time, ServiceAbused, AttackCategory, EventCount, Threshold, SuspicionScore,
CallerARN, CallerType, UniqueIPs, SourceIPs, awsRegion, FirstEvent, LastEventDetects cloud service hijacking using AWS CloudTrail logs in Splunk (sourcetype=aws:cloudtrail from the Splunk Add-on for AWS). Evaluates SES, SNS, and Bedrock API call volumes per IAM principal per 1-hour bucket, alerting when volumes exceed thresholds: SES >100 send operations/hour, SNS >200 publish operations/hour, Bedrock >50 LLM invocations/hour. Filters for successful API calls only (no errorCode present). A suspicion score is calculated from four factors: volume severity relative to threshold (1-3 points), number of unique source IPs >3 (+1), AssumedRole caller type (+1, common in LLMJacking proxy patterns), and suspicious caller ARN naming patterns (+1). Higher scores indicate higher confidence incidents requiring immediate triage.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Legitimate email marketing platforms using AWS SES with high send volumes for newsletters or product launch campaigns
- Application notification services with high transactional email volumes (password resets, order confirmations) during peak traffic hours
- Production ML/AI workloads running high-throughput batch inference via AWS Bedrock in authorized production pipelines
- DevOps load testing environments generating artificially high messaging volumes against SES/SNS endpoints
- Automated CI/CD integration tests that exercise SES/SNS APIs as part of end-to-end test suites
Other platforms for T1496.004
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1AWS SES High-Volume Email Sending Simulation
Expected signal: AWS CloudTrail: 10 events with EventName=SendEmail, EventSource=ses.amazonaws.com, originating from the caller IAM ARN and source IP. CloudWatch Metrics: SES NumberOfEmailsSent increments by 10. Sentinel AWSCloudTrail table: events appear within 5 minutes of AWS CloudTrail delivery delay.
- Test 2AWS SNS SMS Publishing Burst with Promotional Configuration
Expected signal: AWS CloudTrail: SetSMSAttributes event (RequestParameters shows DefaultSMSType=Promotional), CreateTopic event with TopicName=argus-t1496004-test, and 5 x Publish events, all from the same IAM ARN within a short time window. CloudWatch: SNS NumberOfMessagesSent and SMSMonthToDateSpentUSD metrics increment.
- Test 3AWS Bedrock LLM Invocation Burst (LLMJacking Simulation)
Expected signal: AWS CloudTrail: 15 x EventName=InvokeModel, EventSource=bedrock.amazonaws.com, with ModelId=amazon.titan-text-lite-v1 in RequestParameters, all from same IAM ARN and source IP. CloudWatch: Bedrock InvocationCount metric increments by 15. If Bedrock invocation logging is enabled, S3 or CloudWatch Logs capture input prompts and responses.
- Test 4SES Service Enablement Then Immediate Abuse Pattern
Expected signal: AWS CloudTrail: CreateEmailIdentity event followed within seconds by SendEmail event (possibly ErrorCode=MessageRejected if unverified), then GetEmailIdentity event — all from same IAM ARN and source IP within a 1-2 minute window. The sub-minute gap between CreateEmailIdentity and SendEmail is the key forensic indicator.
References (12)
- https://attack.mitre.org/techniques/T1496/004/
- https://www.invictus-ir.com/news/the-curious-case-of-dangerdev-protonmail-me
- https://permiso.io/blog/s/aws-ses-pionage-detecting-ses-abuse/
- https://www.sentinelone.com/labs/sns-sender-active-campaigns-unleash-messaging-spam-through-the-cloud/
- https://sysdig.com/blog/llmjacking-stolen-cloud-credentials-used-in-new-ai-attack/
- https://www.lacework.com/blog/detecting-ai-resource-hijacking-with-composite-alerts
- https://docs.aws.amazon.com/ses/latest/dg/monitor-sending-activity.html
- https://docs.aws.amazon.com/sns/latest/dg/sms_stats_cloudwatch.html
- https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html
- https://docs.microsoft.com/en-us/azure/sentinel/connect-aws-cloudtrail
- https://docs.splunk.com/Documentation/AddOns/released/AWS/CloudTrail
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1496/T1496.md
Unlock Pro Content
Get the full detection package for T1496.004 including response playbook, investigation guide, and atomic red team tests.