NRT Squid proxy events related to mining pools

Severity: low
Source: github.com/Azure/Azure-Sentinel

'Checks for Squid proxy events in Syslog associated with common mining pools .This query presumes the default Squid log format is being used. http://www.squid-cache.org/Doc/config/access_log/'

MITRE ATT&CK coverage

Tactic	Techniques
Command & Control	`T1102` Web Service

Rule body

id: dd03057e-4347-4853-bf1e-2b2d21eb4e59
name: NRT Squid proxy events related to mining pools
description: |
  'Checks for Squid proxy events in Syslog associated with common mining pools .This query presumes the default Squid log format is being used.
   http://www.squid-cache.org/Doc/config/access_log/'
severity: Low
requiredDataConnectors:
  - connectorId: Syslog
    dataTypes:
      - Syslog
  - connectorId: SyslogAma
    dataTypes: 
      - Syslog
tactics:
  - CommandAndControl
relevantTechniques:
  - T1102
query: |
  let DomainList = dynamic(["monerohash.com", "do-dear.com", "xmrminerpro.com", "secumine.net", "xmrpool.com", "minexmr.org", "hashanywhere.com", "xmrget.com",
  "mininglottery.eu", "minergate.com", "moriaxmr.com", "multipooler.com", "moneropools.com", "xmrpool.eu", "coolmining.club", "supportxmr.com",
  "minexmr.com", "hashvault.pro", "xmrpool.net", "crypto-pool.fr", "xmr.pt", "miner.rocks", "walpool.com", "herominers.com", "gntl.co.uk", "semipool.com",
  "coinfoundry.org", "cryptoknight.cc", "fairhash.org", "baikalmine.com", "tubepool.xyz", "fairpool.xyz", "asiapool.io", "coinpoolit.webhop.me", "nanopool.org",
  "moneropool.com", "miner.center", "prohash.net", "poolto.be", "cryptoescrow.eu", "monerominers.net", "cryptonotepool.org", "extrmepool.org", "webcoin.me",
  "kippo.eu", "hashinvest.ws", "monero.farm", "supportxmr.com", "xmrpool.eu", "linux-repository-updates.com", "1gh.com", "dwarfpool.com", "hash-to-coins.com",
  "hashvault.pro", "pool-proxy.com", "hashfor.cash", "fairpool.cloud", "litecoinpool.org", "mineshaft.ml", "abcxyz.stream", "moneropool.ru", "cryptonotepool.org.uk",
  "extremepool.org", "extremehash.com", "hashinvest.net", "unipool.pro", "crypto-pools.org", "monero.net", "backup-pool.com", "mooo.com", "freeyy.me", "cryptonight.net",
  "shscrypto.net"]);
  Syslog
  | where ProcessName contains "squid"
  | extend URL = extract("(([A-Z]+ [a-z]{4,5}:\\/\\/)|[A-Z]+ )([^ :]*)",3,SyslogMessage),
          SourceIP = extract("([0-9]+ )(([0-9]{1,3})\\.([0-9]{1,3})\\.([0-9]{1,3})\\.([0-9]{1,3}))",2,SyslogMessage),
          Status = extract("(TCP_(([A-Z]+)(_[A-Z]+)*)|UDP_(([A-Z]+)(_[A-Z]+)*))",1,SyslogMessage),
          HTTP_Status_Code = extract("(TCP_(([A-Z]+)(_[A-Z]+)*)|UDP_(([A-Z]+)(_[A-Z]+)*))/([0-9]{3})",8,SyslogMessage),
          User = extract("(CONNECT |GET )([^ ]* )([^ ]+)",3,SyslogMessage),
          RemotePort = extract("(CONNECT |GET )([^ ]*)(:)([0-9]*)",4,SyslogMessage),
          Domain = extract("(([A-Z]+ [a-z]{4,5}:\\/\\/)|[A-Z]+ )([^ :\\/]*)",3,SyslogMessage),
          Bytes = toint(extract("([A-Z]+\\/[0-9]{3} )([0-9]+)",2,SyslogMessage)),
          contentType = extract("([a-z/]+$)",1,SyslogMessage)
  | extend TLD = extract("\\.[a-z]*$",0,Domain)
  | where HTTP_Status_Code == '200'
  | where Domain contains "."
  | where Domain has_any (DomainList)
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: User
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: SourceIP
  - entityType: URL
    fieldMappings:
      - identifier: Url
        columnName: URL
version: 1.0.1
kind: NRT

Stages and Predicates

Let binding: `DomainList` used in Stage 7

let DomainList = dynamic(["monerohash.com", "do-dear.com", "xmrminerpro.com", "secumine.net", "xmrpool.com", "minexmr.org", "hashanywhere.com", "xmrget.com",
"mininglottery.eu", "minergate.com", "moriaxmr.com", "multipooler.com", "moneropools.com", "xmrpool.eu", "coolmining.club", "supportxmr.com",
"minexmr.com", "hashvault.pro", "xmrpool.net", "crypto-pool.fr", "xmr.pt", "miner.rocks", "walpool.com", "herominers.com", "gntl.co.uk", "semipool.com",
"coinfoundry.org", "cryptoknight.cc", "fairhash.org", "baikalmine.com", "tubepool.xyz", "fairpool.xyz", "asiapool.io", "coinpoolit.webhop.me", "nanopool.org",
"moneropool.com", "miner.center", "prohash.net", "poolto.be", "cryptoescrow.eu", "monerominers.net", "cryptonotepool.org", "extrmepool.org", "webcoin.me",
"kippo.eu", "hashinvest.ws", "monero.farm", "supportxmr.com", "xmrpool.eu", "linux-repository-updates.com", "1gh.com", "dwarfpool.com", "hash-to-coins.com",
"hashvault.pro", "pool-proxy.com", "hashfor.cash", "fairpool.cloud", "litecoinpool.org", "mineshaft.ml", "abcxyz.stream", "moneropool.ru", "cryptonotepool.org.uk",
"extremepool.org", "extremehash.com", "hashinvest.net", "unipool.pro", "crypto-pools.org", "monero.net", "backup-pool.com", "mooo.com", "freeyy.me", "cryptonight.net",
"shscrypto.net"]);

Stage 1: `source`

Syslog

Stage 2: `where`

| where ProcessName contains "squid"

Stage 3: `extend`

| extend URL = extract("(([A-Z]+ [a-z]{4,5}:\\/\\/)|[A-Z]+ )([^ :]*)",3,SyslogMessage),
        SourceIP = extract("([0-9]+ )(([0-9]{1,3})\\.([0-9]{1,3})\\.([0-9]{1,3})\\.([0-9]{1,3}))",2,SyslogMessage),
        Status = extract("(TCP_(([A-Z]+)(_[A-Z]+)*)|UDP_(([A-Z]+)(_[A-Z]+)*))",1,SyslogMessage),
        HTTP_Status_Code = extract("(TCP_(([A-Z]+)(_[A-Z]+)*)|UDP_(([A-Z]+)(_[A-Z]+)*))/([0-9]{3})",8,SyslogMessage),
        User = extract("(CONNECT |GET )([^ ]* )([^ ]+)",3,SyslogMessage),
        RemotePort = extract("(CONNECT |GET )([^ ]*)(:)([0-9]*)",4,SyslogMessage),
        Domain = extract("(([A-Z]+ [a-z]{4,5}:\\/\\/)|[A-Z]+ )([^ :\\/]*)",3,SyslogMessage),
        Bytes = toint(extract("([A-Z]+\\/[0-9]{3} )([0-9]+)",2,SyslogMessage)),
        contentType = extract("([a-z/]+$)",1,SyslogMessage)

Stage 4: `extend`

| extend TLD = extract("\\.[a-z]*$",0,Domain)

Stage 5: `where`

| where HTTP_Status_Code == '200'

Stage 6: `where`

| where Domain contains "."

Stage 7: `where`

| where Domain has_any (DomainList)

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Domain`	contains	`.`	`field:"Domain" kind:contains value:"."`
`Domain`	match	`1gh.com` transforms: `term` `abcxyz.stream` transforms: `term` `asiapool.io` transforms: `term` `backup-pool.com` transforms: `term` `baikalmine.com` transforms: `term` `coinfoundry.org` transforms: `term` `coinpoolit.webhop.me` transforms: `term` `coolmining.club` transforms: `term` `crypto-pool.fr` transforms: `term` `crypto-pools.org` transforms: `term` `cryptoescrow.eu` transforms: `term` `cryptoknight.cc` transforms: `term` `cryptonight.net` transforms: `term` `cryptonotepool.org` transforms: `term` `cryptonotepool.org.uk` transforms: `term` `do-dear.com` transforms: `term` `dwarfpool.com` transforms: `term` `extremehash.com` transforms: `term` `extremepool.org` transforms: `term` `extrmepool.org` transforms: `term` `fairhash.org` transforms: `term` `fairpool.cloud` transforms: `term` `fairpool.xyz` transforms: `term` `freeyy.me` transforms: `term` `gntl.co.uk` transforms: `term` `hash-to-coins.com` transforms: `term` `hashanywhere.com` transforms: `term` `hashfor.cash` transforms: `term` `hashinvest.net` transforms: `term` `hashinvest.ws` transforms: `term` `hashvault.pro` transforms: `term` `herominers.com` transforms: `term` `kippo.eu` transforms: `term` `linux-repository-updates.com` transforms: `term` `litecoinpool.org` transforms: `term` `miner.center` transforms: `term` `miner.rocks` transforms: `term` `minergate.com` transforms: `term` `mineshaft.ml` transforms: `term` `minexmr.com` transforms: `term` +30 more values (see full rule source)	`field:"Domain" kind:match`
`HTTP_Status_Code`	eq	`200`	`field:"HTTP_Status_Code" kind:eq value:"200"`
`ProcessName`	contains	`squid`	`field:"process_name" kind:contains value:"squid"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`Bytes`	`extend`
`Domain`	`extend`
`HTTP_Status_Code`	`extend`
`RemotePort`	`extend`
`SourceIP`	`extend`
`Status`	`extend`
`URL`	`extend`
`User`	`extend`
`contentType`	`extend`
`TLD`	`extend`

NRT Squid proxy events related to mining pools

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Let binding: DomainList used in Stage 7

Stage 1: source

Stage 2: where

Stage 3: extend

Stage 4: extend

Stage 5: where

Stage 6: where

Stage 7: where