Cryptocurrency Mining Pool Connection Detected
This rule detects network connections to known cryptocurrency mining pools or domains associated with cryptocurrency mining activities. It specifically looks for keywords like 'miningpool', 'stratum', 'xmr', 'ethash', 'moneropool' in the remote URL or specific IP addresses like 'connect.moneropool.com' and 'pool.supportxmr.com'. This activity often indicates unauthorized resource hijacking (cryptojacking) on the affected device.
Microsoft Sentinel (KQL)
