Tangerine Turkey CryptoMiner Detection
This rule detects suspicious process and file activity that may be indicative of a crypto-miner or other malware. Specifically, it looks for the execution of VBScript files with a specific naming convention ('x#######.vbs') via wscript, or batch files with a similar naming convention initiated by wscript. Additionally, it unions these process events with file events where 'printui.exe' or 'printui.dll' are found in 'C:\Windows \System32\'. The rule then summarizes these events by device and flags if both process and file events are observed on the same device within the specified timeframes, suggesting a multi-stage activity.
Microsoft Sentinel (KQL)
