Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-Impact-CloudGPUCryptojackingBurstProvisioning.
Upgrade to ProDetect Cloud GPU / Compute-Optimized Instance Burst Provisioning for Cryptocurrency Mining in Microsoft Sentinel
Once an adversary obtains valid cloud credentials (a leaked IAM access key, an over-permissioned CI/CD service principal, or a session hijacked via token theft), one of the most direct ways to monetize that access is Resource Hijacking: rather than exfiltrating data or staging ransomware, the actor simply rents the victim's own compute at the victim's expense to mine cryptocurrency. The observable pattern is distinctive from routine autoscaling or ML workload provisioning: the actor scripts a burst of RunInstances (AWS) or Microsoft.Compute/virtualMachines/write (Azure) calls requesting GPU-accelerated or bare-metal compute-optimized instance families (AWS p3/p3dn/p4d/p4de/p5, g4dn/g4ad/g5/g5g/g6, trn1/inf2, and .metal families; Azure NC/ND/NV/HB/HC series) — the same instance classes used for legitimate ML training and HPC, chosen specifically for their hash-rate-per-dollar economics rather than any workload the victim actually asked for. Launches are frequently fanned out across multiple regions or even multiple linked accounts/subscriptions in the same short window to slip under any single region's service quota and to slow discovery, since most organizations' cost anomaly alerting operates on a daily or slower cadence while the mining operation itself can be running within minutes of credential compromise. Once running, the instances typically establish outbound TCP connections on ports associated with the Stratum mining protocol (3333, 4444, 5555, 7777, 8080, 14444, 14433, 45560) to a mining pool endpoint, and sustain near-100% CPU/GPU utilization for as long as the credentials remain valid — the direct cost impact (often tens of thousands of dollars within a day for GPU-class instances) is frequently the first signal a victim organization notices, arriving as a shocking cloud bill days after the actual compromise.
MITRE ATT&CK
- Tactic
- Impact
KQL Detection Query
// THREAT-Impact-CloudGPUCryptojackingBurstProvisioning (T1496.001 Resource Hijacking: Compute Hijacking - cloud control plane)
let Lookback = 24h;
let BurstWindow = 1h;
let MinLaunchCount = 5;
let AwsBurst = AWSCloudTrail
| where TimeGenerated > ago(Lookback)
| where EventName == "RunInstances"
| where ErrorCode == "" or isempty(ErrorCode)
| extend InstanceType = tostring(parse_json(tostring(RequestParameters)).instancesSet.items[0].instanceType)
| where InstanceType matches regex @"^(p3|p3dn|p4d|p4de|p5|g4dn|g4ad|g5|g5g|g6|trn1|inf2)\." or InstanceType endswith ".metal"
| summarize LaunchCount = count(), ResourceTypes = make_set(InstanceType), Regions = make_set(AWSRegion), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by UserIdentityArn, RecipientAccountId, bin(TimeGenerated, BurstWindow)
| where LaunchCount >= MinLaunchCount
| extend CloudProvider = "AWS", Identity = UserIdentityArn, AccountOrSubscription = RecipientAccountId;
let AzureBurst = AzureActivity
| where TimeGenerated > ago(Lookback)
| where OperationNameValue == "MICROSOFT.COMPUTE/VIRTUALMACHINES/WRITE"
| where ActivityStatusValue == "Succeeded"
| extend VmSize = tostring(parse_json(tostring(Properties)).responseBody.properties.hardwareProfile.vmSize)
| where VmSize matches regex @"^Standard_(NC|ND|NV|HB|HC)"
| extend VmLocation = tostring(parse_json(tostring(Properties)).responseBody.location)
| summarize LaunchCount = count(), ResourceTypes = make_set(VmSize), Regions = make_set(VmLocation), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by Caller, SubscriptionId, bin(TimeGenerated, BurstWindow)
| where LaunchCount >= MinLaunchCount
| extend CloudProvider = "Azure", Identity = Caller, AccountOrSubscription = SubscriptionId;
union AwsBurst, AzureBurst
| project TimeGenerated, CloudProvider, Identity, AccountOrSubscription, LaunchCount, ResourceTypes, Regions, FirstSeen, LastSeen
| sort by LaunchCount desc, TimeGenerated descCross-cloud detection over AWS CloudTrail and Azure Activity Log for burst provisioning of GPU-accelerated or bare-metal compute-optimized instances by a single identity. AWS side matches successful RunInstances calls whose instance type falls in the p3/p4/p5/g4/g5/g6/trn1/inf2/.metal families; Azure side matches successful virtualMachines write operations whose vmSize is in the NC/ND/NV/HB/HC GPU/HPC series. Both branches group by identity and account/subscription in 1-hour buckets and require 5 or more qualifying launches in that window, since a single GPU instance launch is routine ML/HPC activity but a scripted burst across several is the signature of a mining operation renting the account's compute at scale.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate ML/AI training jobs that intentionally spin up a fleet of GPU instances (e.g. distributed training runs, hyperparameter sweeps) — cross-reference the identity against known data-science automation service principals/roles
- Render farm or VFX/HPC batch jobs that burst-provision compute-optimized or GPU instances for a scheduled rendering window
- Autoscaling groups or Kubernetes cluster autoscalers backing legitimate GPU-accelerated inference workloads that scale out rapidly under load
- Capacity/cost testing or benchmark exercises run by an authorized platform engineering team using the same instance families
- A newly onboarded ML team's first production training run, which will look like a first-time-seen identity launching a burst of GPU instances
Other platforms for THREAT-Impact-CloudGPUCryptojackingBurstProvisioning
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate AWS GPU Instance Burst Launch
Expected signal: AWS CloudTrail management events: eventName=RunInstances, eventSource=ec2.amazonaws.com, requestParameters.instancesSet.items[].instanceType=g4dn.xlarge, five or more events from the same userIdentity.arn within a few minutes.
- Test 2Simulate Azure GPU VM Burst Provisioning
Expected signal: Azure Activity Log entries: operationName=MICROSOFT.COMPUTE/VIRTUALMACHINES/WRITE, resultType=Success, properties.responseBody.properties.hardwareProfile.vmSize=Standard_NC6s_v3, five or more events from the same caller within a few minutes.
- Test 3Simulate Outbound Stratum Mining Pool Connection
Expected signal: VPC Flow Logs / NSG Flow Logs showing an outbound TCP connection attempt from the test instance's ENI to destination port 3333/4444 against the test destination 203.0.113.10.
References (6)
- https://attack.mitre.org/techniques/T1496/001/
- https://attack.mitre.org/tactics/TA0040/
- https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_RunInstances.html
- https://learn.microsoft.com/en-us/azure/virtual-machines/sizes-gpu
- https://aws.amazon.com/blogs/security/how-to-use-aws-cost-anomaly-detection-to-identify-anomalous-spend/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1496.001/T1496.001.md
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-Impact-CloudGPUCryptojackingBurstProvisioning — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month
Related Detections
Tactic Hub
Detection Variants (1)
Different telemetry and tradecraft for the same technique — pick the one that matches the data you collect.