Crowdstrike Cryptomining Tools

Description

Detects execution of cryptocurrency mining tools like XMRig, CGMiner, and ETHMiner that hijack computing resources for unauthorized financial gain. These tools consume significant CPU/GPU resources, degrade system performance, and increase costs. Unauthorized deployment typically indicates compromise through malware, supply chain attacks, or exploitation of vulnerable services.

Query · python

from panther_crowdstrike_fdr_helpers import crowdstrike_detection_alert_context

CRYPTOCURRENCY_MINING_TOOLS = {
    "xmrig.exe",
    "cgminer.exe",
    "bfgminer.exe",
    "ethminer.exe",
    "minergate-cli.exe",
    "nicehashminer.exe",
    "sgminer.exe",
    "cpuminer.exe",
    "cudaminer.exe",
    "nheqminer.exe",
    "claymore.exe",
    "xmr-stak.exe",
    "ccminer.exe",
    "zecminer64.exe",
    "ewbf.exe",
    "nanominer.exe",
    "phoenixminer.exe",
    "t-rex.exe",
    "gminer.exe",
    "lolminer.exe",
    "teamredminer.exe",
    "nbminer.exe",
    "daggerhashimoto.exe",
}


def rule(event):
    if event.get("fdr_event_type", "") == "ProcessRollup2":
        if event.get("event_platform", "") == "Win":
            process_name = (
                event.deep_get("event", "ImageFileName", default="").lower().split("\\")[-1]
            )
            return process_name in CRYPTOCURRENCY_MINING_TOOLS
    return False


def title(event):
    tool = (
        event.deep_get("event", "ImageFileName", default="<TOOL_NOT_FOUND>").lower().split("\\")[-1]
    )
    host = event.get("ComputerName") or event.get("aid", "<AID_NOT_FOUND>")
    return f"Crowdstrike: Cryptocurrency mining tool [{tool}] detected on host [{host}]"


def alert_context(event):
    return crowdstrike_detection_alert_context(event)

Analyst notes

Review the process tree in CrowdStrike for event:ParentBaseFileName and event:SourceProcessId to identify what launched the cryptomining tool and determine the initial access vector
Query CrowdStrike DNS logs and network telemetry from the affected host (aid and aip) in the 24 hours around this event to identify mining pool domains contacted (e.g., xmr-pool.com, nanopool.org, ethermine.org)
Search CrowdStrike for the event:SHA256HashData across all endpoints to identify other hosts running the same cryptomining tool and assess the scope of the cryptojacking campaign

Detection tier

Atomic IOCs
Network & Host Artifacts
Tools
TTPs
Pending classification

Metadata

Source: panther-labs/panther-analysis
License: Apache 2.0
Severity: Critical
Status: Stable
Query type: python
Created: 2023-05-01
Modified: 2026-02-13
Authored by: panther-labs
Source ID
Upstream: rules/crowdstrike_rules/crowdstrike_cryptomining_tools.yml
Type: rule
Version: 2
References: https://www.crowdstrike.com/cybersecurity-101/cryptojacking/
Data sources: Crowdstrike.FDREvent

ATT&CK

TA0040 T1496