Potential Mining Pool Command Detection

Description

This rule detects the execution of a process with potential mining pool commandline arguments. Adversaries may leverage the resources of compromised systems to mine cryptocurrency, to generate revenue. This activity may impact system performance and availability.

Query · eql

process where event.type == "start" and event.action == "exec" and process.parent.executable != null and (
  process.name like (
    "telnet.netkit", "ping", "telnet", "xmrig", "dash", "bash", "sh", "zsh", "ash", "fish", "ksh", "tcsh",
    "csh", "nohup", "pgrep", "python*", "perl*", "ruby*", "php*", "lua*", "sed", "pkill", "docker", "dig",
    "nslookup", "inetutils-telnet", "nc", "ncat", "netcat", "netcat.openbsd", "netcat.traditional", "nc.openbsd",
    "nc.traditional", "curl", "wget", "sudo", "grep", ".*"
  ) or
  process.executable like (
    "/tmp/*", "/var/tmp/*", "/dev/shm/*", "/boot/*", "./*", "/sys/*", "/lost+found/*", "/media/*", "/proc/*",
    "/var/backups/*", "/var/log/*", "/var/mail/*", "/var/spool/*"
  )
) and
process.command_line like (
  "*cnpool.cc*", "*lindon-pool.win*", "*supportxmr.com*", "*comgandalph3000.com*", "*minergate.com*",
  "*fjhan.club*", "*emercoin.com*", "*poolto.be*", "*520fjh.org*", "*xmrpool.xyz*", "*simka.pw*", "*noobxmr.com*",
  "*miner.rocks*", "*minerpool.pw*", "*minemonero.gq*", "*usxmrpool.com*", "*moneroocean.stream*", "*mypool.online*",
  "*xmrpool.de*", "*emergate.net*", "*ip28.net*", "*mine.bz*", "*dwarfpool.com*", "*xmrig.com*", "*koto-pool.work*",
  "*monerorx.com*", "*zarabotaibitok.ru*", "*mining-help.ru*", "*mine2gether.com*", "*moneropool.com*", "*viaxmr.com*",
  "*minerrocks.com*", "*miningpoolhub.com*", "*cortins.tk*", "*pooldd.com*", "*unmineable.com*", "*f2pool.com*",
  "*graef.in*", "*nanopool.org*", "*myxmr.pw*", "*ratchetmining.com*", "*cryptmonero.com*", "*xmrminer.cc*",
  "*riefly.id*", "*iwanttoearn.money*", "*herominers.com*", "*xmrpool.me*", "*miners.pro*", "*luckpool.net*",
  "*twotouchauthentication.online*", "*hashvault.pro*", "*4i7i.com*", "*miningocean.org*", "*2miners.com*",
  "*xmrpool.eu*", "*monerpool.org*", "*joulecoin.org*", "*suprnova.cc*", "*monerocean.stream*", "*bohemianpool.com*", 
  "*crypto-pool.fr*", "*xmr.pt*", "*alimabi.cn*", "*teracycle.net*", "*monerogb.com*", "*armornetwork.org*",
  "*emercoin.net*", "*poolmining.org*", "*minexmr.cn*", "*moriaxmr.com*", "*ethereumpool.co*", "*minercircle.com*",
  "*prohash.net*", "*zer0day.ru*", "*crypto-pool.info*", "*pool.support*", "*siamining.com*", "*5b6b7b.ru*",
  "*c3pool.com*", "*somec.cc*", "*hellominer.com*", "*usa-138.com*", "*mixpools.org*", "*xmrpool.net*",
  "*moneroworld.com*", "*minerxmr.ru*", "*d5pool.us*", "*hashcity.org*", "*hex7e4.ru*", "*zpool.ca*", "*minexmr.com*",
  "*monerohash.com*", "*multipool.us*", "*moneropool.nl*", "*nbminer.com*", "*ppxxmr.com*", "*xmrfast.com*",
  "*webhop.net*", "*ethpool.org*", "*slushpool.com*", "*antpool.com*", "*nicehash.com*", "*nicehash.net*",
  "*zergpool.com*", "*mining-dutch.nl*", "*blockmasters.co*", "*bsod.pw*", "*fairpool.xyz*", "*miningrigrentals.com*",
  "*hashing24.com*", "*ethermine.org*", "*flexpool.io*", "*hiveon.net*", "*sparkpool.com*", "*2miners.org*",
  "*poolin.com*", "*viabtc.com*", "*f2pool.org*", "*coinhive.com*", "*cryptoloot.pro*", "*webmine.cz*",
  "*minero.cc*", "*monerohash.org*", "*monerohash.net*", "*moneropool.ru*", "*moneroocean.stream*", "*rx.unmineable.com*"
) and not (
  process.parent.name in ("sendmail", "postfix-local", "check-quota", "zmcontrol", "find", "timeout", "php") or
  process.name in ("timeout", "host", "ptxas") or
  process.command_line like ("*zpool.cache*", "*app/jobs/ant-sec_observe-income.py*") or
  process.parent.args == "/scripts/run_certbot.sh" or
  process.parent.command_line == "runc init" or
  (process.parent.command_line == "/bin/bash /usr/local/bin/soc_guard.sh" and process.executable == "/usr/bin/grep") or
  (process.parent.name like "php*" and process.command_line like "*/var/tools/koalaping/bin/ping.php*") or
  (
    process.parent.command_line == "/bin/bash /root/nicehash/nicehash_api.sh /main/api/v2/mining/algo/stats" and
    process.command_line like "python3 /root/nicehash/nicehash.py -b https://api2.nicehash.com -o * -m GET -p /main/api/v2/mining/algo/stats"
  )
)
Raw source Potential Mining Pool Command Detection · Elastic TOML
Esc
Published by elastic/protections-artifacts ↗, licensed under Elastic License 2.0 ↗. Reproduced here unmodified. 
[rule]
description = """
This rule detects the execution of a process with potential mining pool commandline arguments. Adversaries may leverage
the resources of compromised systems to mine cryptocurrency, to generate revenue. This activity may impact system
performance and availability.
"""
id = "fcc42a61-4507-4918-867b-d673e5b065dc"
license = "Elastic License v2"
name = "Potential Mining Pool Command Detection"
os_list = ["linux"]
reference = ["https://falco.org/blog/falco-detect-cryptomining/"]
version = "1.0.11"

query = '''
process where event.type == "start" and event.action == "exec" and process.parent.executable != null and (
  process.name like (
    "telnet.netkit", "ping", "telnet", "xmrig", "dash", "bash", "sh", "zsh", "ash", "fish", "ksh", "tcsh",
    "csh", "nohup", "pgrep", "python*", "perl*", "ruby*", "php*", "lua*", "sed", "pkill", "docker", "dig",
    "nslookup", "inetutils-telnet", "nc", "ncat", "netcat", "netcat.openbsd", "netcat.traditional", "nc.openbsd",
    "nc.traditional", "curl", "wget", "sudo", "grep", ".*"
  ) or
  process.executable like (
    "/tmp/*", "/var/tmp/*", "/dev/shm/*", "/boot/*", "./*", "/sys/*", "/lost+found/*", "/media/*", "/proc/*",
    "/var/backups/*", "/var/log/*", "/var/mail/*", "/var/spool/*"
  )
) and
process.command_line like (
  "*cnpool.cc*", "*lindon-pool.win*", "*supportxmr.com*", "*comgandalph3000.com*", "*minergate.com*",
  "*fjhan.club*", "*emercoin.com*", "*poolto.be*", "*520fjh.org*", "*xmrpool.xyz*", "*simka.pw*", "*noobxmr.com*",
  "*miner.rocks*", "*minerpool.pw*", "*minemonero.gq*", "*usxmrpool.com*", "*moneroocean.stream*", "*mypool.online*",
  "*xmrpool.de*", "*emergate.net*", "*ip28.net*", "*mine.bz*", "*dwarfpool.com*", "*xmrig.com*", "*koto-pool.work*",
  "*monerorx.com*", "*zarabotaibitok.ru*", "*mining-help.ru*", "*mine2gether.com*", "*moneropool.com*", "*viaxmr.com*",
  "*minerrocks.com*", "*miningpoolhub.com*", "*cortins.tk*", "*pooldd.com*", "*unmineable.com*", "*f2pool.com*",
  "*graef.in*", "*nanopool.org*", "*myxmr.pw*", "*ratchetmining.com*", "*cryptmonero.com*", "*xmrminer.cc*",
  "*riefly.id*", "*iwanttoearn.money*", "*herominers.com*", "*xmrpool.me*", "*miners.pro*", "*luckpool.net*",
  "*twotouchauthentication.online*", "*hashvault.pro*", "*4i7i.com*", "*miningocean.org*", "*2miners.com*",
  "*xmrpool.eu*", "*monerpool.org*", "*joulecoin.org*", "*suprnova.cc*", "*monerocean.stream*", "*bohemianpool.com*", 
  "*crypto-pool.fr*", "*xmr.pt*", "*alimabi.cn*", "*teracycle.net*", "*monerogb.com*", "*armornetwork.org*",
  "*emercoin.net*", "*poolmining.org*", "*minexmr.cn*", "*moriaxmr.com*", "*ethereumpool.co*", "*minercircle.com*",
  "*prohash.net*", "*zer0day.ru*", "*crypto-pool.info*", "*pool.support*", "*siamining.com*", "*5b6b7b.ru*",
  "*c3pool.com*", "*somec.cc*", "*hellominer.com*", "*usa-138.com*", "*mixpools.org*", "*xmrpool.net*",
  "*moneroworld.com*", "*minerxmr.ru*", "*d5pool.us*", "*hashcity.org*", "*hex7e4.ru*", "*zpool.ca*", "*minexmr.com*",
  "*monerohash.com*", "*multipool.us*", "*moneropool.nl*", "*nbminer.com*", "*ppxxmr.com*", "*xmrfast.com*",
  "*webhop.net*", "*ethpool.org*", "*slushpool.com*", "*antpool.com*", "*nicehash.com*", "*nicehash.net*",
  "*zergpool.com*", "*mining-dutch.nl*", "*blockmasters.co*", "*bsod.pw*", "*fairpool.xyz*", "*miningrigrentals.com*",
  "*hashing24.com*", "*ethermine.org*", "*flexpool.io*", "*hiveon.net*", "*sparkpool.com*", "*2miners.org*",
  "*poolin.com*", "*viabtc.com*", "*f2pool.org*", "*coinhive.com*", "*cryptoloot.pro*", "*webmine.cz*",
  "*minero.cc*", "*monerohash.org*", "*monerohash.net*", "*moneropool.ru*", "*moneroocean.stream*", "*rx.unmineable.com*"
) and not (
  process.parent.name in ("sendmail", "postfix-local", "check-quota", "zmcontrol", "find", "timeout", "php") or
  process.name in ("timeout", "host", "ptxas") or
  process.command_line like ("*zpool.cache*", "*app/jobs/ant-sec_observe-income.py*") or
  process.parent.args == "/scripts/run_certbot.sh" or
  process.parent.command_line == "runc init" or
  (process.parent.command_line == "/bin/bash /usr/local/bin/soc_guard.sh" and process.executable == "/usr/bin/grep") or
  (process.parent.name like "php*" and process.command_line like "*/var/tools/koalaping/bin/ping.php*") or
  (
    process.parent.command_line == "/bin/bash /root/nicehash/nicehash_api.sh /main/api/v2/mining/algo/stats" and
    process.command_line like "python3 /root/nicehash/nicehash.py -b https://api2.nicehash.com -o * -m GET -p /main/api/v2/mining/algo/stats"
  )
)
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1496"
name = "Resource Hijacking"
reference = "https://attack.mitre.org/techniques/T1496/"


[threat.tactic]
id = "TA0040"
name = "Impact"
reference = "https://attack.mitre.org/tactics/TA0040/"

[internal]
min_endpoint_version = "7.15.0"

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.