Potential Crypto Mining Activity via Command Line Arguments
This rule detects the execution of commands or processes that contain specific command-line arguments or strings commonly associated with cryptocurrency mining activities. It looks for parameters such as CPU priority settings, donation levels (often set to zero by malicious miners), pool server addresses (e.g., 'pool.', 'stratum+tcp://', 'stratum+udp://'), and specific mining algorithms like 'rx/0'. The rule also includes base64 encoded versions of some of these strings to evade simple detection. It filters out common false positives like 'pool.c', 'pool.o', and 'gcc -' which might appear in legitimate compilation processes.
Sigma
