Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

T1496.002 Bandwidth Hijacking · cyberstrikeus | DecimalAI

cyberstrikeus/T1496.002_bandwidth-hijacking

SkillScore92Maintained

Adversaries may leverage the network bandwidth resources of co-opted systems to complete resource-intensive tasks, which may impact system and/or hosted service availability.

Securityby cyberstrikeus

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec packmitre-attackenterpriset1496.002

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/cyberstrikeus-t1496-002-bandwidth-hijacking/SKILL.md

decimalai skills pull cyberstrikeus-t1496-002-bandwidth-hijacking --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/cyberstrikeus-t1496-002-bandwidth-hijacking/SKILL.md https://app.decimal.ai/s/cyberstrikeus-t1496-002-bandwidth-hijacking/SKILL.md

Raw file: /s/cyberstrikeus-t1496-002-bandwidth-hijacking/SKILL.md ↗ · machine-readable summary at /s/cyberstrikeus-t1496-002-bandwidth-hijacking.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

24 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 23d ago

Yes — +46% lift0% tokens0% turns92% of whole cases pass with skill (22/24)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-02	✗→✓	▲ Improved	7%	0%
case-07	✗→✓	▲ Improved	-16%	0%
case-09	✗→✓	▲ Improved	-65%	0%
case-10	✗→✓	▲ Improved	24%	0%
case-11	✗→✓	▲ Improved	2%	0%

Showing 5 of 24 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 8/10/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

cyberstrikeus / cyberstrike

.cyberstrike/skill/mitre_attack/TA0040_impact/T1496.002_bandwidth-hijacking/SKILL.md

View on GitHub ↗

License AGPL-3.0Imported 8/10/2026Version v1

Skill contents

SKILL.md

T1496.002 Bandwidth Hijacking

> Sub-technique of: T1496

High-Level Description

Adversaries may leverage the network bandwidth resources of co-opted systems to complete resource-intensive tasks, which may impact system and/or hosted service availability.

Adversaries may also use malware that leverages a system's network bandwidth as part of a botnet in order to facilitate Network Denial of Service campaigns and/or to seed malicious torrents. Alternatively, they may engage in proxyjacking by selling use of the victims' network bandwidth and IP address to proxyware services. Finally, they may engage in internet-wide scanning in order to identify additional targets for compromise.

In addition to incurring potential financial costs or availability disruptions, this technique may cause reputational damage if a victim’s bandwidth is used for illegal activities.

Kill Chain Phase

Impact (TA0040)

Platforms: Linux, Windows, macOS, IaaS, Containers

What to Check

] Identify if Bandwidth Hijacking technique is applicable to target environment
] Check Linux systems for indicators of Bandwidth Hijacking
] Check Windows systems for indicators of Bandwidth Hijacking
] Check macOS systems for indicators of Bandwidth Hijacking
] Assess detection coverage (1 detection strategies)

How to Test

Manual Testing

Identify Attack Surface: Determine if the target environment is susceptible to Bandwidth Hijacking by examining the target platforms (Linux, Windows, macOS).

Assess Existing Defenses: Review whether mitigations for T1496.002 are in place. If defenses are absent or misconfigured, this technique may be exploitable.

Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.

> Note: No Atomic Red Team tests available for this technique. See Atomic Red Team GitHub for updates.

Remediation Guide

No specific mitigations documented for this technique.

Detection

Detect Excessive or Unauthorized Bandwidth Usage for Botnet, Proxyjacking, or Scanning Purposes

Risk Assessment

| Finding | Severity | Impact | | ---------------------------------------- | -------- | ------ | | Bandwidth Hijacking technique applicable | High | Impact |

CWE Categories

| CWE ID | Title | | ------- | --------------------------------- | | CWE-400 | Uncontrolled Resource Consumption |

References

Illustrative Want to see what cyberstrikeus/T1496.002_bandwidth-hijacking would put in front of your model? Preview the rendered body and check its trigger phrases — no LLM call, no signup.

Latest benchmark · publisher runVerified

8/31/2026, 01:23 UTC · 24 cases

Lift

+46%

92% vs 46%

Agent turns

1.0 vs 1.0

Tokens

-1%

2,522.21 vs 2,535

fail → pass · 11pass → pass · 11fail → fail · 2

Per-case results (24)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-01 Our network monitoring team flagged an unusual spike in outbound traffic across several Linux and Windows servers, suggesting potential proxyjacking or botnet activity. Can you provide a structured evaluation guide and checklist to audit these hosts for bandwidth hijacking risks and verify our detection coverage?	fail→fail	29,615	27,923	-6%	1	1	0%	4,060	4,607	+13%	0	0	—
case-02 We suspect some of our cloud containers might be participating in unauthorized internet scanning or proxyware resale. Please generate a risk assessment summary for T1496.002 that outlines the potential impact, primary operating system platforms involved, relevant CWE classifications, and severity evaluations for our threat matrix.	fail→pass	25,219	18,039	-28%	1	1	0%	3,005	3,228	+7%	0	0	—
case-03 I need a step-by-step assessment workflow to manually test our environment's resilience against unauthorized bandwidth consumption. Outline how to verify our attack surface across multi-platform endpoints, assess existing mitigations, and run detection gap checks.	fail→fail	30,192	33,549	+11%	1	1	0%	3,772	5,172	+37%	0	0	—
case-04 When evaluating ATT&CK sub-technique T1496.002 in our security information management platform, which Enterprise ATT&CK tactical phase and parent technique does this threat fall under?	pass→pass	10,412	8,346	-20%	1	1	0%	997	1,078	+8%	0	0	—
case-05 Our threat modeling tool requires mapping MITRE ATT&CK T1496.002 to software weakness standards. Which exact Common Weakness Enumeration identifier is associated with bandwidth hijacking in standard reference mappings?	pass→pass	19,537	7,097	-64%	1	1	0%	2,161	1,086	-50%	0	0	—
case-06 We are defining scope boundaries for a T1496.002 threat hunting program across our hybrid infrastructure. What full set of operating platforms and cloud deployment models should be included in the audit boundary?	pass→pass	26,188	21,199	-19%	1	1	0%	2,961	3,002	+1%	0	0	—
case-07 Our infrastructure team is asking for specific configuration hardening guidelines and remediation controls defined by MITRE for bandwidth hijacking (T1496.002). What official mitigation controls should we implement?	fail→pass	28,530	19,923	-30%	1	1	0%	3,360	2,829	-16%	0	0	—
case-08 We want to execute automated adversary emulation scripts for T1496.002 using open-source validation tools. What is the current status of Atomic Red Team tests for bandwidth hijacking?	pass→pass	23,823	12,265	-49%	1	1	0%	3,173	2,399	-24%	0	0	—
case-09 How many distinct detection strategies are specified for auditing coverage against unauthorized network bandwidth hijacking (T1496.002)?	fail→pass	23,175	7,148	-69%	1	1	0%	2,916	1,021	-65%	0	0	—
case-10 When setting up network traffic monitoring alerts for T1496.002, what specific unauthorized activities should trigger bandwidth monitoring alerts?	fail→pass	22,232	22,635	+2%	1	1	0%	2,553	3,166	+24%	0	0	—
case-11 In our risk matrix template, what specific finding name, severity level, and impact phase are assigned to T1496.002 when evaluating environment applicability?	fail→pass	7,360	7,479	+2%	1	1	0%	1,089	1,113	+2%	0	0	—
case-12 Explain how proxyjacking manifests as a sub-scenario of bandwidth hijacking under ATT&CK T1496.002 and what monetization mechanism adversaries use.	pass→pass	19,471	22,177	+14%	1	1	0%	2,856	2,991	+5%	0	0	—
case-13 In the context of T1496.002 bandwidth hijacking, why do threat actors consume victim host network bandwidth for internet-wide scanning?	pass→pass	19,267	19,639	+2%	1	1	0%	1,996	2,844	+42%	0	0	—
case-14 How do malware authors utilize co-opted bandwidth in botnet operations beyond launching distributed denial of service attacks?	fail→pass	22,248	21,584	-3%	1	1	0%	2,403	3,152	+31%	0	0	—
case-15 Beyond direct infrastructure cost and service availability disruption, what additional business risk is associated with unauthorized bandwidth hijacking?	pass→pass	14,885	17,795	+20%	1	1	0%	2,080	2,482	+19%	0	0	—
case-16 Name real-world malware campaign or research reference examples associated with bandwidth hijacking and proxyjacking documented in T1496.002 literature.	fail→pass	16,111	23,688	+47%	1	1	0%	2,482	3,232	+30%	0	0	—
case-17 When building an endpoint auditing script to verify T1496.002 presence across workstations and servers, what operating system check items must be performed?	pass→pass	28,900	25,821	-11%	1	1	0%	3,856	4,272	+11%	0	0	—
case-18 What is the initial step in a manual testing methodology for assessing susceptibility to bandwidth hijacking?	pass→pass	15,297	1,777	-88%	1	1	0%	1,499	1,013	-32%	0	0	—
case-19 During a manual assessment of T1496.002, what is the purpose of step 2 before executing active traffic simulation?	fail→pass	10,670	7,992	-25%	1	1	0%	1,603	1,276	-20%	0	0	—
case-20 What specific check items are listed in the verification checklist for evaluating T1496.002 in an enterprise environment?	fail→pass	19,068	7,235	-62%	1	1	0%	2,813	1,105	-61%	0	0	—
case-21 What is the official title corresponding to CWE-400 when assessing security risks for bandwidth resource hijacking?	pass→pass	8,496	7,838	-8%	1	1	0%	558	1,046	+87%	0	0	—
case-22 We are conducting a threat assessment for ATT&CK sub-technique T1496.001 (Compute Hijacking), where unauthorized actors consume CPU/GPU cycles for cryptocurrency mining. What standard MITRE mitigations and Atomic Red Team test availability apply to T1496.001?	fail→pass	18,740	19,029	+2%	1	1	0%	3,199	3,216	+1%	0	0	—
case-23 Our security team is assessing T1498 (Network Denial of Service) to determine if it is identical to T1496.002. How do these two techniques differ in terms of adversary intent and ATT&CK tactic classification?	pass→pass	24,756	19,036	-23%	1	1	0%	2,809	3,064	+9%	0	0	—
case-24 We are configuring AWS GuardDuty alerts for EC2 instances mining cryptocurrency. Does T1496.002 cover crypto-mining compute hijacking on AWS EC2 instances, or is crypto-mining categorized under a different sub-technique?	fail→pass	19,776	12,848	-35%	1	1	0%	2,639	2,139	-19%	0	0	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 24 cases were attempted. The headline lift of +46 percentage points is the difference between those two pass rates over the 24 comparable cases.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 45.8%
Pass rate with the skill: 91.7%
Cases attempted: 24
Cases counted toward lift: 24
Cases that regressed: 0
Skill version measured: v1
Run completed: 8/31/2026, 01:23 UTC

Measured example — same prompt, with vs. without the skill · from the benchmark run · case case-02

Prompt

We suspect some of our cloud containers might be participating in unauthorized internet scanning or proxyware resale. Please generate a risk assessment summary for T1496.002 that outlines the potential impact, primary operating system platforms involved, relevant CWE classifications, and severity evaluations for our threat matrix.

Without the skill loaded, the model failed this case. With it loaded, the same prompt on the same model passed. This is one improved case from the latest verified run; every case, including any that regressed, is in the table above.

Show both answers

SkillScore blends 4 signals1 of 4 complete

BenchmarkPass rate WITH skill on a verified run92

Live evalNeeds ≥10 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Efficiency · separate axis (at equal correctness)+0% turns+1% tokens

Shown for transparency; not credited unless a verified run shows no correctness regression.

Backed by 1 of 4 signals — each added signal makes the score more robust.

Verified on gemini-3.6-flash · re-tested 22 days ago

Other measured skills in the registry, with their headline benchmark lift.