Potential Crypto Mining Activity

Title: Potential Crypto Mining Activity
Status: stable
Description:Detects command line parameters or strings often used by crypto miners
References:
  -https://www.poolwatch.io/coin/monero
Author: Florian Roth (Nextron Systems)
Date: 2021-10-26
modified:2023-02-13
Tags:

• -'attack.impact'
• -'attack.t1496'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    CommandLine|contains:
      -' --cpu-priority='
      -'--donate-level=0'
      -' -o pool.'
      -' --nicehash'
      -' --algo=rx/0 '
      -'stratum+tcp://'
      -'stratum+udp://'
      -'LS1kb25hdGUtbGV2ZWw9'
      -'0tZG9uYXRlLWxldmVsP'
      -'tLWRvbmF0ZS1sZXZlbD'
      -'c3RyYXR1bSt0Y3A6Ly'
      -'N0cmF0dW0rdGNwOi8v'
      -'zdHJhdHVtK3RjcDovL'
      -'c3RyYXR1bSt1ZHA6Ly'
      -'N0cmF0dW0rdWRwOi8v'
      -'zdHJhdHVtK3VkcDovL'

  filter:
    CommandLine|contains:
      -' pool.c '
      -' pool.o '
      -'gcc -'

  condition:selection and not filter
Falsepositives:
  -Legitimate use of crypto miners
  -Some build frameworks
Level: high