Cryptomining Compute Hijack via Stratum Protocol
This rule detects cryptomining activity by identifying the Stratum protocol's 'mining.subscribe' message over TCP port 3333. The Stratum protocol is commonly used by cryptocurrency miners to communicate with mining pools. Detection of this specific message indicates an attempt to initiate or participate in cryptomining operations, potentially on a compromised system.
Suricata
