GPU Miner Launches with Pool and Wallet Parameters
Detects a mining process launched with a stratum endpoint, wallet address, worker name, or GPU algorithm arguments. This rule identifies common cryptocurrency mining software (xmrig, lolminer, phoenixminer, nbminer, minerd, miner) when executed with command-line parameters indicative of connecting to a mining pool or specifying wallet/algorithm details.
Microsoft Sentinel (KQL)
