CPU coin-mining via fontdrvhost.exe connecting to Zephyr mining pool
Detects the execution of XMRig cryptocurrency miner or network connections to known mining pool endpoints associated with XMRig, masquerading as or originating from the legitimate Windows process 'fontdrvhost.exe'. This behavior indicates potential resource hijacking.
Microsoft Sentinel (KQL)
