ET COINMINER PrimeCoinMiner.Protominer

Query · suricata

flow:established,to_server;
content:"|01 27 00 00 05 00 00 00 09|"; depth:9;
content:"node"; nocase; within:4;
content:"Protominer"; distance:14; within:10;
Raw source ET COINMINER PrimeCoinMiner.Protominer · Suricata
Esc
Published by Emerging Threats Open ↗, licensed under BSD 3-Clause ↗. Line breaks added for readability; the rule is otherwise unchanged. 
alert tcp $HOME_NET any -> $EXTERNAL_NET 8080: (
    msg:"ET COINMINER PrimeCoinMiner.Protominer";
    flow:established,to_server;
    content:"|01 27 00 00 05 00 00 00 09|"; depth:9;
    content:"node"; nocase; within:4;
    content:"Protominer"; distance:14; within:10;
    reference:md5,4cab48eec2b882ec33db2e2a13ecffe6;
    classtype:coin-mining;
    sid:2018014; rev:2;
    metadata:attack_target Client_Endpoint, created_at 2014_01_27, deployment Perimeter, confidence High, signature_severity Major, tag Coinminer, updated_at 2020_08_19, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1496, mitre_technique_name Resource_Hijacking;
)

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.