Skip to content

Resource hijacking


ID: MS-TA9039
Tactic: Impact
MITRE technique: T1496

Attackers may abuse a compromised resource for running tasks. A common abuse is to use compromised resources for running digital currency mining. Attackers who have access to a container in the cluster or have permissions to create new containers may use them for such activity.


ID Mitigation Description
MS-M9011 Restrict Container Runtime using LSM Restrict execution of unwanted processes in containers.
MS-M9012 Remove Tools from Container Images Remove unused tools from the container image.