Detect outbound connections to common miner pool ports

rule: Detect outbound connections to common miner pool ports
desc: 'Miners usually connect to miner pools using standard ports, and this rule flags
  such activity. Important: Falco currently sends DNS requests to resolve miner pool
  domains, which could trigger other alerts. Prior to enabling this rule, it''s advised
  to ensure whether this is acceptable for your environment. This rule is specifically
  disabled for that reason.

  '
condition: 'net_miner_pool and not trusted_images_query_miner_domain_dns

  '
enabled: false
output: Outbound connection to IP/Port flagged by https://cryptoioc.ch | ip=%fd.rip
  connection=%fd.name lport=%fd.lport rport=%fd.rport fd_type=%fd.type fd_proto=%fd.l4proto
  evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid
  process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline
  terminal=%proc.tty
priority: CRITICAL
tags:
- maturity_sandbox
- host
- container
- network
- mitre_impact
- T1496