ATT&CK T1496 - Cryptomining Pool DNS Lookup

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•2

This rule detects DNS queries for known cryptomining pool domains. It specifically looks for patterns like 'pool.monero', 'pool.xmr', 'pool.minexmr', 'pool.nanopool', and 'pool.supportxmr' within DNS queries, indicating potential cryptomining activity on the network.