Crypto Miner User Agent

Title: Crypto Miner User Agent
Status: test
Description:Detects suspicious user agent strings used by crypto miners in proxy logs
References:
  -https://github.com/xmrig/xmrig/blob/da22b3e6c45825f3ac1f208255126cb8585cd4fc/src/base/kernel/Platform_win.cpp#L65
  -https://github.com/xmrig/xmrig/blob/427b6516e0550200c17ca28675118f0fffcc323f/src/version.h
Author: Florian Roth (Nextron Systems)
Date: 2019-10-21
modified:2021-11-27
Tags:

• -'attack.command-and-control'
• -'attack.t1071.001'

Logsource:

• category: proxy

Detection:
  selection:
    c-useragent|startswith:
      -'XMRig '
      -'ccminer'

  condition:selection
Falsepositives:
  -Unknown
Level: high