DNS Request to Crypto Miner Service

[rule]
description = """
This rule detects DNS queries to miner services via living-off-the-land executables or executables in
world/user-writable directories. Malware authors may use these services to mine cryptocurrency to generate revenue.
"""
id = "66d449ef-25ee-4fa6-8893-0ced843d1915"
license = "Elastic License v2"
name = "DNS Request to Crypto Miner Service"
os_list = ["linux"]
reference = ["https://xmrig.com/docs/algorithms"]
version = "1.0.2"

query = '''
sequence by process.entity_id with maxspan=1m
  [process where event.type == "start" and event.action == "exec" and (
    process.name in (
      "curl", "wget", "bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "busybox",
      "timeout", "env", "node", "deno", "nodejs"
    ) or
    process.name like (".*", "python*", "perl*", "php*", "ruby*", "lua*") or
    process.executable like (
      "./*", "/tmp/*", "/var/tmp/*", "/dev/shm/*", "/run/*", "/var/run/*", "/boot/*", "/sys/*",
      "/lost+found/*", "/proc/*", "/var/mail/*", "/var/www/*", "/home/*/*", "/root/*"
    ) or
    process.working_directory like (
      "/tmp*", "/var/tmp*", "/dev/shm*", "/run*", "/var/run*", "/boot*", "/sys*", "/lost+found*",
      "/proc*", "/var/mail*", "/var/www*", "/home/*/*", "/root/*"
    )
  ) and
  not (process.name like "php*" and process.args in ("/var/tools/koalaping/bin/ping.php", "/var/tools/lean/bin/Lean.php"))]
  [dns where event.action == "lookup_result" and dns.question.name like~ (
    "*cnpool.cc", "*lindon-pool.win", "*supportxmr.com", "*comgandalph3000.com", "*minergate.com",
    "*fjhan.club", "*emercoin.com", "*poolto.be", "*520fjh.org", "*xmrpool.xyz", "*simka.pw", "*noobxmr.com",
    "*miner.rocks", "*minerpool.pw", "*minemonero.gq", "*usxmrpool.com", "*moneroocean.stream", "*mypool.online",
    "*xmrpool.de", "*emergate.net", "*ip28.net", "*mine.bz", "*dwarfpool.com", "*xmrig.com", "*koto-pool.work",
    "*monerorx.com", "*zarabotaibitok.ru", "*mining-help.ru", "*mine2gether.com", "*moneropool.com", "*viaxmr.com",
    "*minerrocks.com", "*miningpoolhub.com", "*cortins.tk", "*pooldd.com", "*unmineable.com", "*f2pool.com",
    "*graef.in", "*nanopool.org", "*myxmr.pw", "*ratchetmining.com", "*cryptmonero.com", "*xmrminer.cc",
    "*riefly.id", "*iwanttoearn.money", "*herominers.com", "*xmrpool.me", "*miners.pro", "*luckpool.net",
    "*twotouchauthentication.online", "*hashvault.pro", "*4i7i.com", "*miningocean.org", "*2miners.com",
    "*xmrpool.eu", "*monerpool.org", "*joulecoin.org", "*suprnova.cc", "*bohemianpool.com",
    "*crypto-pool.fr", "*xmr.pt", "*alimabi.cn", "*teracycle.net", "*monerogb.com", "*armornetwork.org",
    "*emercoin.net", "*poolmining.org", "*minexmr.cn", "*moriaxmr.com", "*ethereumpool.co", "*minercircle.com",
    "*prohash.net", "*zer0day.ru", "*crypto-pool.info", "*pool.support", "*siamining.com", "*5b6b7b.ru",
    "*c3pool.com", "*somec.cc", "*hellominer.com", "*usa-138.com", "*mixpools.org", "*xmrpool.net",
    "*moneroworld.com", "*minerxmr.ru", "*d5pool.us", "*hashcity.org", "*hex7e4.ru", "*zpool.ca", "*minexmr.com",
    "*monerohash.com", "*multipool.us", "*moneropool.nl", "*nbminer.com", "*ppxxmr.com", "*xmrfast.com",
    "*webhop.net", "*ethpool.org", "*slushpool.com", "*antpool.com", "*nicehash.com", "*nicehash.net",
    "*zergpool.com", "*mining-dutch.nl", "*blockmasters.co", "*bsod.pw", "*fairpool.xyz", "*miningrigrentals.com",
    "*hashing24.com", "*ethermine.org", "*flexpool.io", "*hiveon.net", "*sparkpool.com", "*2miners.org",
    "*poolin.com", "*viabtc.com", "*f2pool.org", "*coinhive.com", "*cryptoloot.pro", "*webmine.cz",
    "*minero.cc", "*monerohash.org", "*monerohash.net", "*moneropool.ru", "*moneroocean.stream", "*rx.unmineable.com"
  )]
'''

min_endpoint_version = "9.3.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 1

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1071"
name = "Application Layer Protocol"
reference = "https://attack.mitre.org/techniques/T1071/"
[[threat.technique.subtechnique]]
id = "T1071.004"
name = "DNS"
reference = "https://attack.mitre.org/techniques/T1071/004/"


[[threat.technique]]
id = "T1102"
name = "Web Service"
reference = "https://attack.mitre.org/techniques/T1102/"


[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1496"
name = "Resource Hijacking"
reference = "https://attack.mitre.org/techniques/T1496/"


[threat.tactic]
id = "TA0040"
name = "Impact"
reference = "https://attack.mitre.org/tactics/TA0040/"

[internal]
min_endpoint_version = "9.3.0"