Linux Crypto Mining Pool Connections

Title: Linux Crypto Mining Pool Connections
Status: stable
Description:Detects process connections to a Monero crypto mining pool
References:
  -https://www.poolwatch.io/coin/monero
Author: Florian Roth (Nextron Systems)
Date: 2021-10-26
modified:None
Tags:

• -'attack.impact'
• -'attack.t1496'

Logsource:

• product: linux
• category: network_connection

Detection:
  selection:
    DestinationHostname:
      -'pool.minexmr.com'
      -'fr.minexmr.com'
      -'de.minexmr.com'
      -'sg.minexmr.com'
      -'ca.minexmr.com'
      -'us-west.minexmr.com'
      -'pool.supportxmr.com'
      -'mine.c3pool.com'
      -'xmr-eu1.nanopool.org'
      -'xmr-eu2.nanopool.org'
      -'xmr-us-east1.nanopool.org'
      -'xmr-us-west1.nanopool.org'
      -'xmr-asia1.nanopool.org'
      -'xmr-jp1.nanopool.org'
      -'xmr-au1.nanopool.org'
      -'xmr.2miners.com'
      -'xmr.hashcity.org'
      -'xmr.f2pool.com'
      -'xmrpool.eu'
      -'pool.hashvault.pro'
      -'moneroocean.stream'
      -'monerocean.stream'

  condition:selection
Falsepositives:
  -Legitimate use of crypto miners
Level: high