ATT&CK T1496 - Cryptomining Stratum Protocol Port 3334

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•3

This rule detects network connections to TCP port 3334, which is commonly used by the Stratum protocol for cryptocurrency mining. The rule specifically looks for the initial SYN packet (flags:S) of a TCP connection originating from the home network ($HOME_NET) to any destination. This activity is indicative of potential cryptomining operations within the monitored network.