Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
223 detections
Filters
Last updated
All Time
Detection languages
105
45
18
16
11
Contributors
55
48
19
17
11
Categories
85
79
49
42
38
Platforms
95
83
25
24
20
Products / Services
62
28
27
21
18
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
5
5
5
5
IDS Classtypes
11
4
1
IDS Protocols
6
5
3
2
Detects the 'procq' process establishing network connections to common Monero (XMR) mining pool ports. This behavior is indicative of a cryptominer deployment, specifically associated with the Langflow cryptominer campaign related to CVE-2026-33017.
This rule detects the execution of processes with command line arguments associated with cryptocurrency mining software, such as xmrig, mining pools, or wallet configurations. This is often indicative of resource hijacking.
Detects ScreenConnect or another remote support process directly spawning a mining executable or script. This rule identifies suspicious process creation where a known remote management tool (ScreenConnect, ConnectWiseControl, ClientService) initiates a process with command-line arguments or filenames indicative of cryptocurrency mining (e.g., xmrig, lolminer, nbminer, stratum, wallet, gpu).
This rule detects the execution of processes with command line arguments associated with cryptocurrency mining software, such as xmrig, mining pools, or wallet configurations. This is often indicative of resource hijacking.
Identifies the ScreenConnect Client Service initiating network traffic to the domain 'directdownload.icu', which has been associated with cryptojacking campaigns. This activity indicates potential compromise and resource hijacking.
Correlates RuntimeHost.exe spawning suspended MSBuild.exe to inject mining shellcode, followed by network activity. This behavior is indicative of cryptojacking campaigns abusing ScreenConnect and .NET utilities.
Detects a spoofed utility executable (like CrystalDiskInfo via MSI) loading the malicious autorun.dll from the downloads path, indicative of a cryptojacking campaign.
Detects MSI loading the malicious autorun.dll from temporary download paths, which is indicative of cryptojacking activity often associated with campaigns abusing ScreenConnect and .NET utilities.
This rule detects cryptojacking activity where a silent MSI execution, masquerading as a vcredist_x64.dll load, is used to install and run ScreenConnect. This specific pattern has been observed in campaigns abusing ScreenConnect for GPU mining cryptojacking.
Detects PowerShell downloading an archive and expanding it into a user-writable directory with mining-related filenames or parameters.
Advanced detection correlating RuntimeHost.exe spawning suspended InstallUtil.exe to inject miner. This rule specifically looks for 'RuntimeHost.exe' initiating 'InstallUtil.exe' without command-line arguments, followed by network activity from the 'InstallUtil.exe' process, indicating potential process hollowing and cryptojacking.
This rule detects potential cloud resource hijacking (e.g., cryptojacking) by monitoring for a sudden spike in the deployment of Azure virtual machines by a single user. It triggers if a user creates five or more virtual machines in a 10-minute window, specifically looking for deployments in regions where the user has not recently created VMs, or deployments utilizing high-compute SKUs commonly targeted for cryptocurrency mining.
This rule detects outbound network connections to 'minemine.gleeze.com' on port 8443 originating from specific .NET utility processes (InstallUtil.exe, RegAsm.exe, MSBuild.exe). This activity is indicative of cryptojacking, specifically a campaign abusing ScreenConnect and .NET utilities for GPU mining, as described in the referenced Microsoft blog.
Detects connections to cryptocurrency mining pools
Detects a miner or renamed executable running from a suspicious directory structure within ProgramData with mining command-line characteristics.
Detects PowerShell downloading an archive and expanding it into a user-writable directory with mining-related filenames or parameters. This behavior is indicative of cryptojacking campaigns where adversaries use compromised systems to mine cryptocurrency.
Detects a miner or renamed executable running from a hidden-looking ProgramData directory with mining command-line characteristics. This often indicates cryptojacking activity where an attacker is using system resources for cryptocurrency mining without authorization.
Detects malware copying itself as RuntimeHost.exe into a localized cache directory (D3F4E2A1) while ScreenConnect.ClientService.exe is running, indicating potential cryptojacking activity.
Correlates RuntimeHost.exe spawning suspended RegAsm.exe to inject mining shellcode, followed by network activity. This behavior is indicative of cryptojacking campaigns abusing ScreenConnect and .NET utilities for process hollowing.
Identifies the creation of scheduled tasks for Windows System Health Monitor persistence, specifically looking for 'schtasks.exe' creating tasks with names like 'Windows System Health Monitor' or 'Windows System Health Check', in conjunction with 'RuntimeHost.exe' activity. This pattern is indicative of cryptojacking campaigns abusing ScreenConnect.
This rule detects outbound network communication to a known command and control (C2) IP address (193.42.11.108) on port 8041, specifically when initiated by processes named 'RuntimeHost.exe' or 'InstallUtil.exe'. This activity is indicative of cryptojacking, potentially leveraging ScreenConnect for initial access or persistence, as described in the referenced Microsoft blog.
Page 7 of 11