XMRig/procq Monero miner deployment and stratum pool activity (lambsys campaign)

Ibrahim Saud@tektrix

•updated Jun 26, 2026•0•0•4

Detects potential unauthorized cryptocurrency mining activity by correlating process execution, network connections to known mining pools or C2 IPs, and the presence of known miner binaries in temporary directories. The rule calculates a confidence score based on the overlap of these behavioral indicators.