XMRig Cryptominer Phoning Home to Mining Pool

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•2

This rule detects network traffic patterns indicative of the XMRig cryptominer communicating with a mining pool. Specifically, it looks for HTTP POST requests to the URI '/api/v1/jobs' with 'job_id' present in the client body, which is a common behavior for XMRig when requesting mining jobs.