Known Cryptominer Process Executed

rule: Known Cryptominer Process Executed
desc: 'Detects execution of known cryptocurrency mining software by matching process
  names against a list of common miners. Cryptominers are commonly deployed by attackers
  after gaining initial access to monetize compromised systems. This rule complements
  the existing "Detect crypto miners using the Stratum protocol" rule by catching
  miners that may use renamed binaries but still match known miner process names.
  Consider tuning this rule if you have legitimate mining operations in your environment.

  '
condition: 'spawned_process and is_miner_process

  '
output: Cryptominer process executed | process=%proc.name exe=%proc.exepath evt_type=%evt.type
  user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid parent=%proc.pname
  command=%proc.cmdline terminal=%proc.tty exe_flags=%evt.arg.flags
priority: CRITICAL
tags:
- maturity_sandbox
- host
- container
- process
- mitre_impact
- T1496