Monero Crypto Coin Mining Pool Lookup

Title: Monero Crypto Coin Mining Pool Lookup
Status: stable
Description:Detects suspicious DNS queries to Monero mining pools
References:
  -https://www.nextron-systems.com/2021/10/24/monero-mining-pool-fqdns/
Author: Florian Roth (Nextron Systems)
Date: 2021-10-24
modified:None
Tags:

• -'attack.impact'
• -'attack.t1496'
• -'attack.exfiltration'
• -'attack.t1567'

Logsource:

• category: dns

Detection:
  selection:
    query|contains:
      -'pool.minexmr.com'
      -'fr.minexmr.com'
      -'de.minexmr.com'
      -'sg.minexmr.com'
      -'ca.minexmr.com'
      -'us-west.minexmr.com'
      -'pool.supportxmr.com'
      -'mine.c3pool.com'
      -'xmr-eu1.nanopool.org'
      -'xmr-eu2.nanopool.org'
      -'xmr-us-east1.nanopool.org'
      -'xmr-us-west1.nanopool.org'
      -'xmr-asia1.nanopool.org'
      -'xmr-jp1.nanopool.org'
      -'xmr-au1.nanopool.org'
      -'xmr.2miners.com'
      -'xmr.hashcity.org'
      -'xmr.f2pool.com'
      -'xmrpool.eu'
      -'pool.hashvault.pro'

  condition:selection
Falsepositives:
  -Legitimate crypto coin mining
Level: high