Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-Impact-CloudGPUCryptojackingBurstProvisioning.
Upgrade to ProDetect Cloud GPU / Compute-Optimized Instance Burst Provisioning for Cryptocurrency Mining in Google Chronicle
Once an adversary obtains valid cloud credentials (a leaked IAM access key, an over-permissioned CI/CD service principal, or a session hijacked via token theft), one of the most direct ways to monetize that access is Resource Hijacking: rather than exfiltrating data or staging ransomware, the actor simply rents the victim's own compute at the victim's expense to mine cryptocurrency. The observable pattern is distinctive from routine autoscaling or ML workload provisioning: the actor scripts a burst of RunInstances (AWS) or Microsoft.Compute/virtualMachines/write (Azure) calls requesting GPU-accelerated or bare-metal compute-optimized instance families (AWS p3/p3dn/p4d/p4de/p5, g4dn/g4ad/g5/g5g/g6, trn1/inf2, and .metal families; Azure NC/ND/NV/HB/HC series) — the same instance classes used for legitimate ML training and HPC, chosen specifically for their hash-rate-per-dollar economics rather than any workload the victim actually asked for. Launches are frequently fanned out across multiple regions or even multiple linked accounts/subscriptions in the same short window to slip under any single region's service quota and to slow discovery, since most organizations' cost anomaly alerting operates on a daily or slower cadence while the mining operation itself can be running within minutes of credential compromise. Once running, the instances typically establish outbound TCP connections on ports associated with the Stratum mining protocol (3333, 4444, 5555, 7777, 8080, 14444, 14433, 45560) to a mining pool endpoint, and sustain near-100% CPU/GPU utilization for as long as the credentials remain valid — the direct cost impact (often tens of thousands of dollars within a day for GPU-class instances) is frequently the first signal a victim organization notices, arriving as a shocking cloud bill days after the actual compromise.
MITRE ATT&CK
- Tactic
- Impact
YARA-L Detection Query
rule cloud_gpu_cryptojacking_burst_provisioning {
meta:
author = "df00tech Detection Engineering"
description = "Detects burst provisioning of GPU-accelerated or compute-optimized cloud instances consistent with cryptocurrency mining resource hijacking"
reference = "https://attack.mitre.org/techniques/T1496/001/"
severity = "HIGH"
priority = "HIGH"
mitre_attack_tactic = "Impact"
mitre_attack_technique = "T1496.001"
false_positives = "ML/HPC training bursts, render farm batch jobs, GPU autoscalers, capacity/benchmark testing"
version = "1.0"
events:
$e.metadata.event_type = "USER_RESOURCE_CREATION"
(
(
$e.metadata.vendor_name = "Amazon"
$e.metadata.product_event_type = "RunInstances"
re.regex($e.target.resource.attribute.labels.instance_type, `(?i)^(p3|p3dn|p4d|p4de|p5|g4dn|g4ad|g5|g5g|g6|trn1|inf2)\.|\.metal$`)
) or
(
$e.metadata.vendor_name = "Microsoft"
$e.metadata.product_event_type = "MICROSOFT.COMPUTE/VIRTUALMACHINES/WRITE"
re.regex($e.target.resource.attribute.labels.vm_size, `(?i)^Standard_(NC|ND|NV|HB|HC)`)
)
)
$identity = $e.principal.user.userid
match:
$identity over 1h
condition:
#e >= 5
}Chronicle YARA-L 2.0 rule matching USER_RESOURCE_CREATION UDM events from AWS CloudTrail and Azure Activity Log. Fires on RunInstances calls for GPU/metal instance-type families and virtualMachines write operations for NC/ND/NV/HB/HC vmSizes. Groups by calling principal over a 1-hour window and requires 5 or more matching events, surfacing the burst pattern characteristic of a scripted compute-hijacking operation rather than a single legitimate GPU launch.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate distributed ML training or hyperparameter sweep bursts
- Render farm/VFX/HPC batch jobs scheduled to burst-provision GPU capacity
- Cluster autoscalers backing legitimate GPU-accelerated inference workloads
- Authorized capacity or benchmark testing using the same instance families
- First production training run from a newly onboarded ML team
Other platforms for THREAT-Impact-CloudGPUCryptojackingBurstProvisioning
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate AWS GPU Instance Burst Launch
Expected signal: AWS CloudTrail management events: eventName=RunInstances, eventSource=ec2.amazonaws.com, requestParameters.instancesSet.items[].instanceType=g4dn.xlarge, five or more events from the same userIdentity.arn within a few minutes.
- Test 2Simulate Azure GPU VM Burst Provisioning
Expected signal: Azure Activity Log entries: operationName=MICROSOFT.COMPUTE/VIRTUALMACHINES/WRITE, resultType=Success, properties.responseBody.properties.hardwareProfile.vmSize=Standard_NC6s_v3, five or more events from the same caller within a few minutes.
- Test 3Simulate Outbound Stratum Mining Pool Connection
Expected signal: VPC Flow Logs / NSG Flow Logs showing an outbound TCP connection attempt from the test instance's ENI to destination port 3333/4444 against the test destination 203.0.113.10.
References (6)
- https://attack.mitre.org/techniques/T1496/001/
- https://attack.mitre.org/tactics/TA0040/
- https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_RunInstances.html
- https://learn.microsoft.com/en-us/azure/virtual-machines/sizes-gpu
- https://aws.amazon.com/blogs/security/how-to-use-aws-cost-anomaly-detection-to-identify-anomalous-spend/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1496.001/T1496.001.md
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-Impact-CloudGPUCryptojackingBurstProvisioning — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month
Related Detections
Tactic Hub
Detection Variants (1)
Different telemetry and tradecraft for the same technique — pick the one that matches the data you collect.