ATT&CK T1496 - Cryptomining Stratum Protocol Port 3333

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•2

This rule detects network traffic on TCP port 3333, which is commonly associated with the Stratum protocol used in cryptocurrency mining. The rule specifically looks for the initiation of a TCP connection (SYN flag) to this port from the home network to any destination. This activity could indicate the presence of cryptomining malware or unauthorized cryptomining operations within the network.