Linux Crypto Mining Indicators
This rule detects command-line parameters and strings commonly associated with cryptocurrency mining software, specifically targeting Monero miners like XMRig. It looks for specific arguments such as CPU priority settings, donation levels, pool addresses (e.g., 'pool.', 'stratum+tcp://', 'stratum+udp://'), algorithm specifications ('--algo=rx/0'), and base64 encoded versions of these strings. It also includes a specific command for loading the 'msr' kernel module, which can be used by miners to optimize performance.
Sigma
