Detect Cloud Service Hijacking in Sumo Logic CSE
Adversaries may leverage compromised software-as-a-service (SaaS) applications to complete resource-intensive tasks, impacting hosted service availability and incurring significant financial costs for victims. Primary attack vectors include: (1) Email/SMS spam campaigns abusing AWS Simple Email Service (SES), AWS Simple Notification Service (SNS), SendGrid, and Twilio to send bulk phishing or spam messages using the victim's service quotas and sending reputation; (2) LLMJacking, where adversaries use stolen cloud credentials to proxy AI model inference requests (AWS Bedrock, Azure OpenAI) through reverse proxies, effectively monetizing access to expensive LLM compute while billing the victim; (3) Enabling previously inactive cloud SaaS services and immediately exploiting them at scale. Threat actor DangerDev (documented by Invictus IR) abused AWS SES for large-scale phishing campaigns, SNS Sender toolkits (documented by SentinelOne) enable SMS pumping at scale, and LLMJacking campaigns (documented by Sysdig and Lacework) demonstrate adversaries reselling stolen LLM API access.
MITRE ATT&CK
- Tactic
- Impact
- Technique
- T1496 Resource Hijacking
- Sub-technique
- T1496.004 Cloud Service Hijacking
- Canonical reference
- https://attack.mitre.org/techniques/T1496/004/
Sumo Detection Query
_sourceCategory=*cloudtrail*
| json "eventSource", "eventName", "errorCode", "userIdentity.arn", "userIdentity.type", "sourceIPAddress", "awsRegion", "recipientAccountId" as EventSource, EventName, ErrorCode, UserArn, UserType, SourceIP, AWSRegion, AccountId nodrop
| where isNull(ErrorCode) or ErrorCode = ""
| where EventSource in ("ses.amazonaws.com", "sns.amazonaws.com", "bedrock.amazonaws.com")
| where EventName in (
"SendEmail", "SendRawEmail", "SendBulkTemplatedEmail", "SendBulkEmail", "SendTemplatedEmail",
"Publish", "PublishBatch",
"InvokeModel", "InvokeModelWithResponseStream", "CreateModelInvocationJob", "InvokeAgent"
)
| eval ServiceAbused = if(EventSource = "ses.amazonaws.com", "AWS SES",
if(EventSource = "sns.amazonaws.com", "AWS SNS",
if(EventSource = "bedrock.amazonaws.com", "AWS Bedrock", "Unknown")))
| eval AttackCategory = if(ServiceAbused = "AWS SES", "Email Spam or Phishing Campaign",
if(ServiceAbused = "AWS SNS", "SMS Pumping or Bulk Spam",
if(ServiceAbused = "AWS Bedrock", "LLM Resource Hijacking (LLMJacking)", "SaaS Abuse")))
| eval Threshold = if(ServiceAbused = "AWS SES", 100,
if(ServiceAbused = "AWS SNS", 200, 50))
| timeslice 1h
| count as EventCount by _timeslice, ServiceAbused, AttackCategory, Threshold, UserArn, UserType, SourceIP, AWSRegion, AccountId
| where EventCount > Threshold
| eval SuspicionScore = if(EventCount > Threshold * 10, 3,
if(EventCount > Threshold * 3, 2, 1))
| eval SuspicionScore = if(UserType = "AssumedRole", SuspicionScore + 1, SuspicionScore)
| sort by -SuspicionScore, -EventCount
| fields _timeslice, ServiceAbused, AttackCategory, EventCount, Threshold, SuspicionScore, UserArn, UserType, SourceIP, AWSRegion, AccountIdDetects Cloud Service Hijacking (T1496.004) by parsing AWS CloudTrail JSON logs, filtering to successful SES/SNS/Bedrock API calls matching known abuse operations, bucketing by 1-hour timeslices, and applying service-specific thresholds (SES >100/hr, SNS >200/hr, Bedrock >50/hr) per caller identity. SuspicionScore is elevated for high multiples over threshold and for AssumedRole callers (common in credential theft scenarios). Requires CloudTrail logs to be forwarded to Sumo Logic with _sourceCategory containing 'cloudtrail'. The JSON operator extracts fields directly from the raw CloudTrail event payload.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate marketing email platforms (Klaviyo, HubSpot) relaying through SES will generate high SendEmail volumes on scheduled campaign days — baseline expected send windows and IAM ARN patterns per environment
- SNS-backed alerting infrastructure (PagerDuty integrations, CloudWatch alarms) generating burst Publish events during incidents or deployment windows — correlate with ops runbooks
- Analytics or content moderation pipelines invoking Bedrock InvokeModel in parallelized batch jobs — these typically run as Lambda execution roles with predictable ARN patterns that can be excluded
Other platforms for T1496.004
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1AWS SES High-Volume Email Sending Simulation
Expected signal: AWS CloudTrail: 10 events with EventName=SendEmail, EventSource=ses.amazonaws.com, originating from the caller IAM ARN and source IP. CloudWatch Metrics: SES NumberOfEmailsSent increments by 10. Sentinel AWSCloudTrail table: events appear within 5 minutes of AWS CloudTrail delivery delay.
- Test 2AWS SNS SMS Publishing Burst with Promotional Configuration
Expected signal: AWS CloudTrail: SetSMSAttributes event (RequestParameters shows DefaultSMSType=Promotional), CreateTopic event with TopicName=argus-t1496004-test, and 5 x Publish events, all from the same IAM ARN within a short time window. CloudWatch: SNS NumberOfMessagesSent and SMSMonthToDateSpentUSD metrics increment.
- Test 3AWS Bedrock LLM Invocation Burst (LLMJacking Simulation)
Expected signal: AWS CloudTrail: 15 x EventName=InvokeModel, EventSource=bedrock.amazonaws.com, with ModelId=amazon.titan-text-lite-v1 in RequestParameters, all from same IAM ARN and source IP. CloudWatch: Bedrock InvocationCount metric increments by 15. If Bedrock invocation logging is enabled, S3 or CloudWatch Logs capture input prompts and responses.
- Test 4SES Service Enablement Then Immediate Abuse Pattern
Expected signal: AWS CloudTrail: CreateEmailIdentity event followed within seconds by SendEmail event (possibly ErrorCode=MessageRejected if unverified), then GetEmailIdentity event — all from same IAM ARN and source IP within a 1-2 minute window. The sub-minute gap between CreateEmailIdentity and SendEmail is the key forensic indicator.
References (12)
- https://attack.mitre.org/techniques/T1496/004/
- https://www.invictus-ir.com/news/the-curious-case-of-dangerdev-protonmail-me
- https://permiso.io/blog/s/aws-ses-pionage-detecting-ses-abuse/
- https://www.sentinelone.com/labs/sns-sender-active-campaigns-unleash-messaging-spam-through-the-cloud/
- https://sysdig.com/blog/llmjacking-stolen-cloud-credentials-used-in-new-ai-attack/
- https://www.lacework.com/blog/detecting-ai-resource-hijacking-with-composite-alerts
- https://docs.aws.amazon.com/ses/latest/dg/monitor-sending-activity.html
- https://docs.aws.amazon.com/sns/latest/dg/sms_stats_cloudwatch.html
- https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html
- https://docs.microsoft.com/en-us/azure/sentinel/connect-aws-cloudtrail
- https://docs.splunk.com/Documentation/AddOns/released/AWS/CloudTrail
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1496/T1496.md
Unlock Pro Content
Get the full detection package for T1496.004 including response playbook, investigation guide, and atomic red team tests.