DNS Queries to Cryptocurrency Mining Pools
This rule identifies DNS queries made to domains associated with known cryptocurrency mining pools. It specifically looks for DNS queries where the 'query' field ends with any of the listed mining pool domains. The rule excludes queries with answers '127.0.0.1' or '0.0.0.0' and those marked as rejected, to reduce false positives. The primary goal is to detect potential resource hijacking through cryptomining on compromised systems.
Sigma
