PyPI Impersonation Cryptomining Malware Execution
This rule detects patterns indicative of cryptomining malware execution, specifically targeting those distributed via impersonated PyPI packages. It looks for Python processes exhibiting characteristics such as: 1. Command lines containing keywords related to mining, cryptocurrency, hashing, and mining pools. 2. Python processes making suspicious network connections to stratum+tcp or mining pools. 3. Python processes engaging in resource-intensive operations like multiprocessing or threading, often utilizing all available CPU cores. 4. Python processes executing obfuscated code, potentially involving base64, zlib, or gzip decoding, combined with network requests. The rule triggers if any of these conditions are met, or if a combination of suspicious network activity and resource-intensive behavior, or obfuscated execution and resource-intensive behavior, is observed.
Sigma
