Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
223 detections
Filters
Last updated
All Time
Detection languages
105
45
18
16
11
Contributors
55
48
19
17
11
Categories
85
79
49
42
38
Platforms
95
83
25
24
20
Products / Services
62
28
27
21
18
MITRE Techniques
18,114
15,633
12,576
8,388
6,215
CVEs
5
5
5
5
IDS Classtypes
11
4
1
IDS Protocols
6
5
3
2
This rule detects activities associated with the 'clean.sh' script often used by cryptocurrency miners to remove competing miner processes, terminate services, clear persistence mechanisms (cron jobs), and delete artifacts from temporary directories like /tmp, /var/tmp, or /dev/shm.
This rule detects potential cryptocurrency mining activity where known miner executables (specifically XMRig) or malicious scripts/processes are masquerading as or being spawned by 'LockAppHost.exe' or 'LockAppHost14a02b.exe'. It also monitors for subsequent attempts by these processes to terminate security-related tasks or establish persistence via registry run keys.
This rule detects potential cryptocurrency mining activity where known miner executables (specifically XMRig) or malicious scripts/processes are masquerading as or being spawned by 'LockAppHost.exe' or 'LockAppHost14a02b.exe'. It also monitors for subsequent attempts by these processes to terminate security-related tasks or establish persistence via registry run keys.
This rule detects potential cryptocurrency mining activity where known miner executables (specifically XMRig) or malicious scripts/processes are masquerading as or being spawned by 'LockAppHost.exe' or 'LockAppHost14a02b.exe'. It also monitors for subsequent attempts by these processes to terminate security-related tasks or establish persistence via registry run keys.
This rule detects the presence of XMRig cryptocurrency mining binaries, including those associated with the MayaBot campaign, by inspecting file contents for characteristic strings, configuration parameters, and executable signatures.
Detects high CPU utilization (exceeding 80%) on VMware ESXi hosts during non-business hours (between 22:00 and 06:00). Such activity may indicate unauthorized resource hijacking, such as cryptocurrency mining, or performance degradation due to unexpected processes.
This rule detects a significant spike in usage for Azure Cognitive Services, specifically for operations like Chat Completions or Image Generation. By comparing the request count per caller to their historical average (hourly), the rule identifies potential abuse, service disruption, or unauthorized resource usage.
Detects Mach-O binaries embedding XMRig/Monero mining strings together with stratum mining protocol URIs and typical miner CLI flags, consistent with Monero miners dropped and executed as root following macOS Screen Sharing compromise.
Detects execution of Monero mining indicators by a root-privileged process descended from screensharingd or its file-copy helpers, within 30 minutes of a Screen Sharing session on the host.
This rule identifies newly created cloud accounts (AWS or Google Cloud) that exhibit immediate and high-volume API activity within an hour of their creation. This pattern is indicative of resource hijacking, where attackers exploit promotional or startup cloud credits to perform unauthorized tasks, such as hosting proxied API services for resale.
Detects sustained outbound Stratum mining-protocol connections to Monero mining pools from a compromised host (5+ connections within 5 minutes), consistent with post-exploitation cryptomining following Screen Sharing compromise.
Detects users or applications whose AI API token consumption or spend is sustained above a dynamic baseline across multiple consecutive time buckets rather than a single burst, which may indicate token jacking, credential theft, or abuse of stolen AI API keys via gray-market proxy services.
Detects cloning and building xmrig-proxy from source (git clone + cmake/make), used by JadeProx operators to relay cryptomining traffic from compromised hosts behind a single mining pool connection. Build commands must specifically reference the xmrig-proxy repository or directory to reduce false positives from generic development builds.
Detects initiated network connections to crypto mining pools
Detects cloning and building xmrig-proxy from source (git clone + cmake/make), used by JadeProx operators to relay cryptomining traffic from compromised hosts behind a single mining pool connection. Build commands must specifically reference the xmrig-proxy repository or directory to reduce false positives from generic development builds.
Detects cloning and building xmrig-proxy from source (git clone + cmake/make), used by JadeProx operators to relay cryptomining traffic from compromised hosts behind a single mining pool connection. Build commands must specifically reference the xmrig-proxy repository or directory to reduce false positives from generic development builds.
Detects DNS queries targeted towards specific '2miners.com' solo mining pool subdomains (e.g., solo-zeph.2miners.com, solo-rvn.2miners.com). Such activity is often associated with unauthorized cryptocurrency mining (cryptojacking) performed on compromised systems.
Detects the execution of XMRig cryptocurrency miner or network connections to known mining pool endpoints associated with XMRig, masquerading as or originating from the legitimate Windows process 'fontdrvhost.exe'. This behavior indicates potential resource hijacking.
This rule detects a correlation between an unauthorized IAM user access event and the subsequent execution of cryptocurrency mining tools within the same AWS account within a one-hour window. This is a strong indicator of an adversary leveraging compromised cloud credentials to perform resource hijacking.
This rule detects an unusually high volume of object close operations (Event ID 4658) by a single user on a single computer within a one-hour window. This activity could indicate various malicious behaviors, including data collection for exfiltration, attempts to delete numerous files, or resource exhaustion attacks.
Detects high severity (>= 9.0) AWS GuardDuty findings indicating that an EC2 instance or ECS cluster has been compromised, typically suggesting active exploitation or control by a malicious actor.
Page 5 of 11