detection.wiki

Detection rules › Kusto

NRT DNS events related to mining pools

Status
available
Severity
low
Source
github.com/Azure/Azure-Sentinel

'Identifies IP addresses that may be performing DNS lookups associated with common currency mining pools.'

MITRE ATT&CK coverage

TacticTechniques
Impact

Rule body

id: d5b32cd4-2328-43da-ab47-cd289c1f5efc
name: NRT DNS events related to mining pools
description: |
  'Identifies IP addresses that may be performing DNS lookups associated with common currency mining pools.'
severity: Low
status: Available
requiredDataConnectors:
  - connectorId: DNS
    dataTypes:
      - DnsEvents
tactics:
  - Impact
relevantTechniques:
  - T1496
query: |
  DnsEvents
  | where Name contains "."
  | where Name has_any ("monerohash.com", "do-dear.com", "xmrminerpro.com", "secumine.net", "xmrpool.com", "minexmr.org", "hashanywhere.com",
  "xmrget.com", "mininglottery.eu", "minergate.com", "moriaxmr.com", "multipooler.com", "moneropools.com", "xmrpool.eu", "coolmining.club",
  "supportxmr.com", "minexmr.com", "hashvault.pro", "xmrpool.net", "crypto-pool.fr", "xmr.pt", "miner.rocks", "walpool.com", "herominers.com",
  "gntl.co.uk", "semipool.com", "coinfoundry.org", "cryptoknight.cc", "fairhash.org", "baikalmine.com", "tubepool.xyz", "fairpool.xyz", "asiapool.io",
  "coinpoolit.webhop.me", "nanopool.org", "moneropool.com", "miner.center", "prohash.net", "poolto.be", "cryptoescrow.eu", "monerominers.net", "cryptonotepool.org",
  "extrmepool.org", "webcoin.me", "kippo.eu", "hashinvest.ws", "monero.farm", "supportxmr.com", "xmrpool.eu", "linux-repository-updates.com", "1gh.com",
  "dwarfpool.com", "hash-to-coins.com", "hashvault.pro", "pool-proxy.com", "hashfor.cash", "fairpool.cloud", "litecoinpool.org", "mineshaft.ml", "abcxyz.stream",
  "moneropool.ru", "cryptonotepool.org.uk", "extremepool.org", "extremehash.com", "hashinvest.net", "unipool.pro", "crypto-pools.org", "monero.net",
  "backup-pool.com", "mooo.com", "freeyy.me", "cryptonight.net", "shscrypto.net")
  | extend HostName = iff(Computer has '.', substring(Computer,0,indexof(Computer,'.')),Computer)
  | extend DnsDomain = iff(Computer has '.', substring(Computer,indexof(Computer,'.')+1),"")
entityMappings:
  - entityType: Host
    fieldMappings:
      - identifier: FullName
        columnName: Computer
      - identifier: HostName
        columnName: HostName
      - identifier: DnsDomain
        columnName: DnsDomain
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: ClientIP
version: 1.0.2
kind: NRT

Stages and Predicates

Stage 1: source

DnsEvents

Stage 2: where

| where Name contains "."

Stage 3: where

| where Name has_any ("monerohash.com", "do-dear.com", "xmrminerpro.com", "secumine.net", "xmrpool.com", "minexmr.org", "hashanywhere.com",
"xmrget.com", "mininglottery.eu", "minergate.com", "moriaxmr.com", "multipooler.com", "moneropools.com", "xmrpool.eu", "coolmining.club",
"supportxmr.com", "minexmr.com", "hashvault.pro", "xmrpool.net", "crypto-pool.fr", "xmr.pt", "miner.rocks", "walpool.com", "herominers.com",
"gntl.co.uk", "semipool.com", "coinfoundry.org", "cryptoknight.cc", "fairhash.org", "baikalmine.com", "tubepool.xyz", "fairpool.xyz", "asiapool.io",
"coinpoolit.webhop.me", "nanopool.org", "moneropool.com", "miner.center", "prohash.net", "poolto.be", "cryptoescrow.eu", "monerominers.net", "cryptonotepool.org",
"extrmepool.org", "webcoin.me", "kippo.eu", "hashinvest.ws", "monero.farm", "supportxmr.com", "xmrpool.eu", "linux-repository-updates.com", "1gh.com",
"dwarfpool.com", "hash-to-coins.com", "hashvault.pro", "pool-proxy.com", "hashfor.cash", "fairpool.cloud", "litecoinpool.org", "mineshaft.ml", "abcxyz.stream",
"moneropool.ru", "cryptonotepool.org.uk", "extremepool.org", "extremehash.com", "hashinvest.net", "unipool.pro", "crypto-pools.org", "monero.net",
"backup-pool.com", "mooo.com", "freeyy.me", "cryptonight.net", "shscrypto.net")

Stage 4: extend

| extend HostName = iff(Computer has '.', substring(Computer,0,indexof(Computer,'.')),Computer)
HostName =
ifComputer has "."substring(Computer, 0, indexof(Computer, '.'))
elseComputer

Stage 5: extend

| extend DnsDomain = iff(Computer has '.', substring(Computer,indexof(Computer,'.')+1),"")
DnsDomain =
ifComputer has "."substring(Computer, (indexof(Computer, '.') + 1))
else""

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
Namecontains
  • .
field:"Name" kind:contains value:"."
Namematch
  • 1gh.com transforms: term
  • abcxyz.stream transforms: term
  • asiapool.io transforms: term
  • backup-pool.com transforms: term
  • baikalmine.com transforms: term
  • coinfoundry.org transforms: term
  • coinpoolit.webhop.me transforms: term
  • coolmining.club transforms: term
  • crypto-pool.fr transforms: term
  • crypto-pools.org transforms: term
  • cryptoescrow.eu transforms: term
  • cryptoknight.cc transforms: term
  • cryptonight.net transforms: term
  • cryptonotepool.org transforms: term
  • cryptonotepool.org.uk transforms: term
  • do-dear.com transforms: term
  • dwarfpool.com transforms: term
  • extremehash.com transforms: term
  • extremepool.org transforms: term
  • extrmepool.org transforms: term
  • fairhash.org transforms: term
  • fairpool.cloud transforms: term
  • fairpool.xyz transforms: term
  • freeyy.me transforms: term
  • gntl.co.uk transforms: term
  • hash-to-coins.com transforms: term
  • hashanywhere.com transforms: term
  • hashfor.cash transforms: term
  • hashinvest.net transforms: term
  • hashinvest.ws transforms: term
  • hashvault.pro transforms: term
  • herominers.com transforms: term
  • kippo.eu transforms: term
  • linux-repository-updates.com transforms: term
  • litecoinpool.org transforms: term
  • miner.center transforms: term
  • miner.rocks transforms: term
  • minergate.com transforms: term
  • mineshaft.ml transforms: term
  • minexmr.com transforms: term
  • +30 more values (see full rule source)
field:"Name" kind:match

Output fields

These fields are emitted when the rule matches.

FieldSource
HostNameextend
DnsDomainextend