Redis Cryptomining Botnet IOC Hunt (Operation CameraSwarm) Known Indicators
This rule detects network connections from monitored devices to known cryptomining pool IP addresses and domain names. It monitors DeviceNetworkEvents for indicators of compromise (IOCs) associated with cryptomining activities, identifying potential resource hijacking on internal endpoints.
Microsoft Sentinel (KQL)
