XMRig Cryptominer - Pool Execution Command Line
Detects execution of the XMRig Monero cryptominer or a miner launched with XMRig-specific pool and tuning arguments. In the AhsayCBS exploitation campaign attackers dropped XMRig onto compromised backup servers to hijack CPU resources for Monero mining, severely degrading server performance. Detection keys on XMRig binary names and the mining command-line grammar (stratum pool URLs, donate-level and thread-hint flags).
YARA-L
