Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5 detections
Filters
Last updated
All Time
Detection languages
3
2
Contributors
2
1
1
1
Categories
2
2
2
1
1
Platforms
2
2
1
Products / Services
1
1
1
1
1
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
Detects miner binaries and watchdog scripts associated with the CVE-2026-33017 Langflow cryptominer campaign being staged in hidden directories under /var/tmp, specifically /var/tmp/.xlamb/ and related files used to evade detection. The rule looks for file events or process events where the folder path or file name matches known indicators like '/var/tmp/.xlamb', '/var/tmp/init_rmount', 'lambsys', 'lambsys.elf', or 'init_rmount', or if the process command line contains these paths/filenames.
Detects suspicious cron job executions or the execution of a potentially trojanized 'crontab' binary. Adversaries, as seen with malware like Perfctl, may replace or modify the 'crontab' utility to hide malicious scheduled tasks from administrators. This detection looks for common patterns of malicious cron jobs.
'Detects suspicious user agent strings used by crypto miners in proxy logs.'
This query was originally published in the threat analytics report, Exploitation of CVE-2019-0708 (BlueKeep).
CVE-2019-0708, also known as BlueKeep, is a critical remote code execution vulnerability involving RDP. Soon after its disclosure, the NSA issued a rare advisory about this vulnerability, out of concern that it could be used to quickly spread malware. Attackers have since used this vulnerability to install cryptocurrency miners on targets.
Microsoft has issued updates for this vulnerability, as well as guidance for protecting operating systems that we no longer support. Microsoft Defender ATP also contains behavioral detections for defending against this threat.
The following query locates devices where the known coin miner payload was dropped.
References:
https://nvd.nist.gov/vuln/detail/CVE-2019-0708
https://www.nsa.gov/News-Features/News-Stories/Article-View/Article/1865726/nsa-cybersecurity-advisory-patch-remote-desktop-services-on-legacy-versions-of/
https://www.wired.com/story/bluekeep-hacking-cryptocurrency-mining/
https://portal.msrc.microsoft.com/security-guidance/advisory/CVE-2019-0708
https://support.microsoft.com/help/4500705/customer-guidance-for-cve-2019-0708
https://www.microsoft.com/security/blog/2019/11/07/the-new-cve-2019-0708-rdp-exploit-attacks-explained/
CVE-2019-0708, also known as BlueKeep, is a critical remote code execution vulnerability involving RDP. Soon after its disclosure, the NSA issued a rare advisory about this vulnerability, out of concern that it could be used to quickly spread malware. Attackers have since used this vulnerability to install cryptocurrency miners on targets.
Microsoft has issued updates for this vulnerability, as well as guidance for protecting operating systems that we no longer support. Microsoft Defender ATP also contains behavioral detections for defending against this threat.
The following query locates devices where the known coin miner payload was dropped.
References:
https://nvd.nist.gov/vuln/detail/CVE-2019-0708
https://www.nsa.gov/News-Features/News-Stories/Article-View/Article/1865726/nsa-cybersecurity-advisory-patch-remote-desktop-services-on-legacy-versions-of/
https://www.wired.com/story/bluekeep-hacking-cryptocurrency-mining/
https://portal.msrc.microsoft.com/security-guidance/advisory/CVE-2019-0708
https://support.microsoft.com/help/4500705/customer-guidance-for-cve-2019-0708
https://www.microsoft.com/security/blog/2019/11/07/the-new-cve-2019-0708-rdp-exploit-attacks-explained/
This rule detects suspicious user agent strings commonly associated with cryptocurrency miners (XMRig and CCMiner) in proxy logs. The presence of these user agents indicates that a system on the network might be infected with mining malware and is attempting to communicate with mining pools or command and control servers.
