Crypto Miner User Agent Detection
This rule detects suspicious user agent strings commonly associated with cryptocurrency miners (XMRig and CCMiner) in proxy logs. The presence of these user agents indicates that a system on the network might be infected with mining malware and is attempting to communicate with mining pools or command and control servers.
Sigma
