Potential Crypto Mining Activity
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Detects command line parameters or strings often used by crypto miners
Severity
Trouble
Rule Requirement
Criteria
Action1: actionname = "Process started" AND COMMANDLINE contains " --cpu-priority=,--donate-level=0, -o pool., --nicehash, --algo=rx/0 ,stratum+tcp://,stratum+udp://,LS1kb25hdGUtbGV2ZWw9,0tZG9uYXRlLWxldmVsP,tLWRvbmF0ZS1sZXZlbD,c3RyYXR1bSt0Y3A6Ly,N0cmF0dW0rdGNwOi8v,zdHJhdHVtK3RjcDovL,c3RyYXR1bSt1ZHA6Ly,N0cmF0dW0rdWRwOi8v,zdHJhdHVtK3VkcDovL" AND COMMANDLINE notcontains " pool.c , pool.o ,gcc -" select Action1.HOSTNAME,Action1.MESSAGE,Action1.COMMANDLINE,Action1.FILE_NAME,Action1.PROCESSNAME,Action1.USERNAME,Action1.PARENTPROCESSNAME
Detection
Execution Mode
realtime
Log Sources
Windows
Author
Florian Roth (Nextron Systems)
