kinsing-miner-download

Description

This query was originally published in the threat analytics report, Sysrv botnet evolution. Sysrv is a Go-based botnet that targets both Windows and Linux servers, and steals resources to mine cryptocurrency. The following query finds instances where the attacker commanded the Kinsing miner file to be downloaded on Linux devices.

Query · kql

DeviceProcessEvents
| where ProcessCommandLine has_all('curl', '-o /etc/kinsing')
Raw source kinsing-miner-download · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: b7d58293-7cb6-4e39-8788-03447f971f96
name: kinsing-miner-download
description: |
  This query was originally published in the threat analytics report, Sysrv botnet evolution.
  Sysrv is a Go-based botnet that targets both Windows and Linux servers, and steals resources to mine cryptocurrency.
  The following query finds instances where the attacker commanded the Kinsing miner file to be downloaded on Linux devices.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
query: |
  DeviceProcessEvents
  | where ProcessCommandLine has_all('curl', '-o /etc/kinsing')

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.