Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
223 detections
Filters
Last updated
All Time
Detection languages
105
45
18
16
11
Contributors
55
48
19
17
11
Categories
85
79
49
42
38
Platforms
95
83
25
24
20
Products / Services
62
28
27
21
18
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
5
5
5
5
IDS Classtypes
11
4
1
IDS Protocols
6
5
3
2
Detects connections to cryptocurrency mining pools
Detects a mining process launched with a stratum endpoint, wallet address, worker name, or GPU algorithm arguments. This rule identifies common cryptocurrency mining software (xmrig, lolminer, phoenixminer, nbminer, minerd, miner) when executed with command-line parameters indicative of connecting to a mining pool or specifying wallet/algorithm details.
Detects a script or small watchdog process repeatedly launching the same miner on one device within a short period. This behavior is indicative of cryptojacking activity where a persistent mechanism ensures the cryptocurrency miner continues to run even if terminated.
Detects a CPU miner configured with an unusually high thread count or affinity mask after GPU capability checks. This behavior is indicative of cryptojacking activity where an attacker is attempting to maximize CPU resource utilization for cryptocurrency mining.
This rule detects an unusually high volume of object close operations (Event ID 4658) by a single user on a single computer within a one-hour window. This activity could indicate various malicious behaviors, including data collection for exfiltration, attempts to delete numerous files, or resource exhaustion attacks.
Detects the creation or deletion of Kubernetes namespaces and nodes via the API server. This activity can indicate an adversary attempting to establish persistence, expand their control, or disrupt the environment within a Kubernetes cluster.
This rule detects various stages of a cryptojacking campaign, as described by Microsoft, involving initial access via autorun.dll sideloading, silent MSI installations, execution of RuntimeHost.exe from suspicious locations, scheduled task creation for persistence, .NET process hollowing, Windows Defender exclusions, and persistence via Startup folder shortcuts and Registry Run keys. The campaign leverages ScreenConnect for remote access and .NET utilities for process hollowing, ultimately leading to GPU mining cryptojacking.
This rule detects an unusually high volume of object close operations (Event ID 4658) by a single user on a single computer within a one-hour window. This activity could indicate various malicious behaviors, including data collection for exfiltration, attempts to delete numerous files, or resource exhaustion attacks.
This rule detects various stages of a cryptojacking campaign, as described by Microsoft, involving initial access via autorun.dll sideloading, silent MSI installations, execution of RuntimeHost.exe from suspicious locations, scheduled task creation for persistence, .NET process hollowing, Windows Defender exclusions, and persistence via Startup folder shortcuts and Registry Run keys. The campaign leverages ScreenConnect for remote access and .NET utilities for process hollowing, ultimately leading to GPU mining cryptojacking.
Detects RuntimeHost.exe launched from an unusual cache directory frequently associated with malware staging and cryptomining activity.
Detects DNS lookups to known cryptocurrency mining pool domains
This rule detects network connections to TCP port 3334, which is commonly used by the Stratum protocol for cryptocurrency mining. The rule specifically looks for the initial SYN packet (flags:S) of a TCP connection originating from the home network ($HOME_NET) to any destination. This activity is indicative of potential cryptomining operations within the monitored network.
This rule detects various stages of a cryptojacking campaign, as described by Microsoft, involving initial access via autorun.dll sideloading, silent MSI installations, execution of RuntimeHost.exe from suspicious locations, scheduled task creation for persistence, .NET process hollowing, Windows Defender exclusions, and persistence via Startup folder shortcuts and Registry Run keys. The campaign leverages ScreenConnect for remote access and .NET utilities for process hollowing, ultimately leading to GPU mining cryptojacking.
This rule detects DNS queries for known cryptomining pool domains. It specifically looks for patterns like 'pool.monero', 'pool.xmr', 'pool.minexmr', 'pool.nanopool', and 'pool.supportxmr' within DNS queries, indicating potential cryptomining activity on the network.
This rule detects network traffic on TCP port 3333, which is commonly associated with the Stratum protocol used in cryptocurrency mining. The rule specifically looks for the initiation of a TCP connection (SYN flag) to this port from the home network to any destination. This activity could indicate the presence of cryptomining malware or unauthorized cryptomining operations within the network.
This rule detects various suspicious activities associated with a cryptojacking campaign, including the execution of 'RuntimeHost.exe' from unusual directories, creation of suspicious scheduled tasks, DLL side-loading followed by silent MSI execution, process hollowing into .NET utilities, Windows Defender exclusion attempts, and persistence mechanisms via startup folder shortcuts and registry run keys. These activities are indicative of an attacker establishing persistence and evading defenses to perform unauthorized cryptocurrency mining.
This rule detects network connections to TCP port 45700, which is a default port used by the XMRig cryptocurrency miner. The detection specifically looks for the initiation of a connection (SYN flag) from the internal network ($HOME_NET) to any external host. This activity is indicative of a system within the internal network potentially running an XMRig miner, which aligns with the MITRE ATT&CK technique T1496 (Resource Hijacking).
Detects RuntimeHost.exe launched from an unusual cache directory frequently associated with malware staging and cryptomining activity.
Detects Mini Shai-Hulud supply-chain malware (router_init.js / router_runtime.js / tanstack_runner.js)
Detects Mini Shai-Hulud supply-chain malware (router_init.js / router_runtime.js / tanstack_runner.js)
This rule detects the launch of Amazon EC2 instances with GPU-enabled or very large instance types. Adversaries may launch such instances for resource-intensive tasks like cryptocurrency mining or other compute-heavy operations, which can lead to unexpected cloud costs and resource hijacking.
Page 8 of 11