Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
36 detections
Filters
Last updated
All Time
Detection languages
18
7
6
1
1
Contributors
9
6
5
5
3
Categories
16
11
11
8
8
Platforms
14
11
10
5
3
Products / Services
10
6
4
4
3
MITRE Techniques
18,114
15,633
12,576
8,388
6,214
IDS Classtypes
4
2
IDS Protocols
5
1
Detects outbound network traffic matching XMRig Monero cryptocurrency miner stratum login behavior originating from an internal host.
Detects outbound network traffic matching XMRig Monero cryptocurrency miner stratum login behavior originating from an internal host.
Detects outbound network traffic matching XMRig Monero cryptocurrency miner stratum login behavior originating from an internal host.
Detects outbound network traffic matching XMRig Monero cryptocurrency miner stratum login behavior originating from an internal host.
This rule detects network connections to known cryptomining pool IP addresses and domain names, as well as file or process executions matching specific hashes associated with known miner samples. It monitors for communication to command-and-control (C2) servers potentially used for cryptomining operations.
This rule detects network connections to known cryptomining pool IP addresses and domain names, as well as file or process executions matching specific hashes associated with known miner samples. It monitors for communication to command-and-control (C2) servers potentially used for cryptomining operations.
This rule detects network connections to known cryptomining pool IP addresses and domain names, as well as file or process executions matching specific hashes associated with known miner samples. It monitors for communication to command-and-control (C2) servers potentially used for cryptomining operations.
This rule detects network connections to known cryptomining pool IP addresses and domain names, as well as file or process executions matching specific hashes associated with known miner samples. It monitors for communication to command-and-control (C2) servers potentially used for cryptomining operations.
This rule detects network connections to known cryptomining pool IP addresses and domain names, as well as file or process executions matching specific hashes associated with known miner samples. It monitors for communication to command-and-control (C2) servers potentially used for cryptomining operations.
This rule detects a correlation between an unauthorized IAM user access event and the subsequent execution of cryptocurrency mining tools within the same AWS account within a one-hour window. This is a strong indicator of an adversary leveraging compromised cloud credentials to perform resource hijacking.
This rule detects potential cloud resource hijacking (e.g., cryptojacking) by monitoring for a sudden spike in the deployment of Azure virtual machines by a single user. It triggers if a user creates five or more virtual machines in a 10-minute window, specifically looking for deployments in regions where the user has not recently created VMs, or deployments utilizing high-compute SKUs commonly targeted for cryptocurrency mining.
Detects potential unauthorized cryptocurrency mining activity by correlating process execution, network connections to known mining pools or C2 IPs, and the presence of known miner binaries in temporary directories. The rule calculates a confidence score based on the overlap of these behavioral indicators.
This rule detects potential cloud resource hijacking (e.g., cryptojacking) by monitoring for a sudden spike in the deployment of Azure virtual machines by a single user. It triggers if a user creates five or more virtual machines in a 10-minute window, specifically looking for deployments in regions where the user has not recently created VMs, or deployments utilizing high-compute SKUs commonly targeted for cryptocurrency mining.
This rule detects the execution of processes with command line arguments associated with cryptocurrency mining software, such as xmrig, mining pools, or wallet configurations. This is often indicative of resource hijacking.
This rule detects the execution of processes with command line arguments associated with cryptocurrency mining software, such as xmrig, mining pools, or wallet configurations. This is often indicative of resource hijacking.
This rule detects potential cloud resource hijacking (e.g., cryptojacking) by monitoring for a sudden spike in the deployment of Azure virtual machines by a single user. It triggers if a user creates five or more virtual machines in a 10-minute window, specifically looking for deployments in regions where the user has not recently created VMs, or deployments utilizing high-compute SKUs commonly targeted for cryptocurrency mining.
Detects connections to cryptocurrency mining pools
Detects connections to cryptocurrency mining pools
This rule detects cryptomining activity by identifying the Stratum protocol's 'mining.subscribe' message over TCP port 3333. The Stratum protocol is commonly used by cryptocurrency miners to communicate with mining pools. Detection of this specific message indicates an attempt to initiate or participate in cryptomining operations, potentially on a compromised system.
Detects DNS lookups to known cryptocurrency mining pool domains
This rule detects network traffic patterns indicative of the XMRig cryptominer communicating with a mining pool. Specifically, it looks for HTTP POST requests to the URI '/api/v1/jobs' with 'job_id' present in the client body, which is a common behavior for XMRig when requesting mining jobs.
Page 1 of 2