Cryptocurrency Miner Execution from Web Server or Temp Directory

Aaron Beardslee@abeardslee

•updated Jan 29, 2026•18•6•277

Detects execution of cryptocurrency mining software often spawned by web server processes or executed from temporary directories. This behavior is common in post-exploitation scenarios, such as those involving vulnerabilities like XWiki CVE-2025-24893, where attackers deploy miners like XMRig. Sysmon For Linux EventID 1 is the best way to detect this behavior.