Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-Impact-CloudGPUCryptojackingBurstProvisioning.
Upgrade to ProDetect Cloud GPU / Compute-Optimized Instance Burst Provisioning for Cryptocurrency Mining in Sumo Logic CSE
Once an adversary obtains valid cloud credentials (a leaked IAM access key, an over-permissioned CI/CD service principal, or a session hijacked via token theft), one of the most direct ways to monetize that access is Resource Hijacking: rather than exfiltrating data or staging ransomware, the actor simply rents the victim's own compute at the victim's expense to mine cryptocurrency. The observable pattern is distinctive from routine autoscaling or ML workload provisioning: the actor scripts a burst of RunInstances (AWS) or Microsoft.Compute/virtualMachines/write (Azure) calls requesting GPU-accelerated or bare-metal compute-optimized instance families (AWS p3/p3dn/p4d/p4de/p5, g4dn/g4ad/g5/g5g/g6, trn1/inf2, and .metal families; Azure NC/ND/NV/HB/HC series) — the same instance classes used for legitimate ML training and HPC, chosen specifically for their hash-rate-per-dollar economics rather than any workload the victim actually asked for. Launches are frequently fanned out across multiple regions or even multiple linked accounts/subscriptions in the same short window to slip under any single region's service quota and to slow discovery, since most organizations' cost anomaly alerting operates on a daily or slower cadence while the mining operation itself can be running within minutes of credential compromise. Once running, the instances typically establish outbound TCP connections on ports associated with the Stratum mining protocol (3333, 4444, 5555, 7777, 8080, 14444, 14433, 45560) to a mining pool endpoint, and sustain near-100% CPU/GPU utilization for as long as the credentials remain valid — the direct cost impact (often tens of thousands of dollars within a day for GPU-class instances) is frequently the first signal a victim organization notices, arriving as a shocking cloud bill days after the actual compromise.
MITRE ATT&CK
- Tactic
- Impact
Sumo Detection Query
(_sourceCategory="aws/cloudtrail"
eventName="RunInstances"
and (_raw matches "*p3.*" or _raw matches "*p4d*" or _raw matches "*p5.*" or _raw matches "*g4dn*" or _raw matches "*g4ad*" or _raw matches "*g5*" or _raw matches "*g6.*" or _raw matches "*trn1*" or _raw matches "*inf2*" or _raw matches "*.metal*"))
or (_sourceCategory="azure/activitylogs"
operationName="MICROSOFT.COMPUTE/VIRTUALMACHINES/WRITE"
and (_raw matches "*Standard_NC*" or _raw matches "*Standard_ND*" or _raw matches "*Standard_NV*" or _raw matches "*Standard_HB*" or _raw matches "*Standard_HC*"))
| eval CloudProvider = if(_sourceCategory="aws/cloudtrail", "AWS", "Azure")
| eval Identity = if(CloudProvider="AWS", userIdentity.arn, caller)
| eval AccountOrSub = if(CloudProvider="AWS", recipientAccountId, subscriptionId)
| timeslice 1h
| stats count as LaunchCount by CloudProvider, Identity, AccountOrSub, _timeslice
| where LaunchCount >= 5
| sort by LaunchCount descSumo Logic Cloud SIEM search spanning AWS CloudTrail and Azure Activity Log sources for GPU/compute-optimized instance provisioning. Groups into 1-hour timeslices per identity and flags 5 or more qualifying launches as the burst pattern characteristic of a mining operation rather than a single routine ML/HPC launch.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate distributed ML training or hyperparameter sweep bursts
- Render farm/VFX/HPC batch jobs scheduled to burst-provision GPU capacity
- Cluster autoscalers backing legitimate GPU-accelerated inference workloads
- Authorized capacity or benchmark testing using the same instance families
- First production training run from a newly onboarded ML team
Other platforms for THREAT-Impact-CloudGPUCryptojackingBurstProvisioning
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate AWS GPU Instance Burst Launch
Expected signal: AWS CloudTrail management events: eventName=RunInstances, eventSource=ec2.amazonaws.com, requestParameters.instancesSet.items[].instanceType=g4dn.xlarge, five or more events from the same userIdentity.arn within a few minutes.
- Test 2Simulate Azure GPU VM Burst Provisioning
Expected signal: Azure Activity Log entries: operationName=MICROSOFT.COMPUTE/VIRTUALMACHINES/WRITE, resultType=Success, properties.responseBody.properties.hardwareProfile.vmSize=Standard_NC6s_v3, five or more events from the same caller within a few minutes.
- Test 3Simulate Outbound Stratum Mining Pool Connection
Expected signal: VPC Flow Logs / NSG Flow Logs showing an outbound TCP connection attempt from the test instance's ENI to destination port 3333/4444 against the test destination 203.0.113.10.
References (6)
- https://attack.mitre.org/techniques/T1496/001/
- https://attack.mitre.org/tactics/TA0040/
- https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_RunInstances.html
- https://learn.microsoft.com/en-us/azure/virtual-machines/sizes-gpu
- https://aws.amazon.com/blogs/security/how-to-use-aws-cost-anomaly-detection-to-identify-anomalous-spend/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1496.001/T1496.001.md
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-Impact-CloudGPUCryptojackingBurstProvisioning — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month
Related Detections
Tactic Hub
Detection Variants (1)
Different telemetry and tradecraft for the same technique — pick the one that matches the data you collect.