Remote Management Client Launches a Miner
Detects ScreenConnect or another remote support process directly spawning a mining executable or script. This rule identifies suspicious process creation where a known remote management tool (ScreenConnect, ConnectWiseControl, ClientService) initiates a process with command-line arguments or filenames indicative of cryptocurrency mining (e.g., xmrig, lolminer, nbminer, stratum, wallet, gpu).
Microsoft Sentinel (KQL)
