Detect crypto miners using the Stratum protocol

Description

Miners commonly specify the mining pool to connect to using a URI that starts with "stratum+tcp". However, this rule is highly specific to this technique, and matching command-line arguments can generally be bypassed quite easily.

Query · falco

spawned_process and (proc.cmdline contains "stratum+tcp" or
     proc.cmdline contains "stratum2+tcp" or
     proc.cmdline contains "stratum+ssl" or
     proc.cmdline contains "stratum2+ssl")

Rule dependencies

Depends on

  • composes · Falco macro spawned_process
    A shared condition, not a detection — not indexed on this site.

Analyst notes

Possible miner running | evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty exe_flags=%evt.arg.flags

Raw source Detect crypto miners using the Stratum protocol · Falco YAML
Esc
Published by falcosecurity/rules ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
rule: Detect crypto miners using the Stratum protocol
desc: 'Miners commonly specify the mining pool to connect to using a URI that starts
  with "stratum+tcp". However, this rule is highly specific to this technique, and
  matching command-line arguments can generally be bypassed quite easily.

  '
condition: "spawned_process and (proc.cmdline contains \"stratum+tcp\" or\n     proc.cmdline\
  \ contains \"stratum2+tcp\" or\n     proc.cmdline contains \"stratum+ssl\" or\n\
  \     proc.cmdline contains \"stratum2+ssl\")\n"
output: Possible miner running | evt_type=%evt.type user=%user.name user_uid=%user.uid
  user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname
  command=%proc.cmdline terminal=%proc.tty exe_flags=%evt.arg.flags
priority: CRITICAL
tags:
- maturity_sandbox
- host
- container
- process
- mitre_impact
- T1496

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.