detection.wiki

Detection rules › Sigma

Potential Crypto Mining Activity

Status
stable
Severity
high
Log source
category process_creation, product windows
Author
Florian Roth (Nextron Systems)
Source
github.com/SigmaHQ/sigma

Detects command line parameters or strings often used by crypto miners

Known false positives

  • Legitimate use of crypto miners
  • Some build frameworks

MITRE ATT&CK coverage

TacticTechniques
Impact

Telemetry coverage

ProviderRecord / event type
SysmonEvent ID 1: Process creation
Security-AuditingEvent ID 4688: A new process has been created.

Rule body

title: Potential Crypto Mining Activity
id: 66c3b204-9f88-4d0a-a7f7-8a57d521ca55
status: stable
description: Detects command line parameters or strings often used by crypto miners
references:
    - https://www.poolwatch.io/coin/monero
author: Florian Roth (Nextron Systems)
date: 2021-10-26
modified: 2023-02-13
tags:
    - attack.impact
    - attack.t1496
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains:
            - ' --cpu-priority='
            - '--donate-level=0'
            - ' -o pool.'
            - ' --nicehash'
            - ' --algo=rx/0 '
            - 'stratum+tcp://'
            - 'stratum+udp://'
            # base64 encoded: --donate-level=
            - 'LS1kb25hdGUtbGV2ZWw9'
            - '0tZG9uYXRlLWxldmVsP'
            - 'tLWRvbmF0ZS1sZXZlbD'
            # base64 encoded: stratum+tcp:// and stratum+udp://
            - 'c3RyYXR1bSt0Y3A6Ly'
            - 'N0cmF0dW0rdGNwOi8v'
            - 'zdHJhdHVtK3RjcDovL'
            - 'c3RyYXR1bSt1ZHA6Ly'
            - 'N0cmF0dW0rdWRwOi8v'
            - 'zdHJhdHVtK3VkcDovL'
    filter:
        CommandLine|contains:
            - ' pool.c '
            - ' pool.o '
            - 'gcc -'
    condition: selection and not filter
falsepositives:
    - Legitimate use of crypto miners
    - Some build frameworks
level: high

Stages and Predicates

Stage 0: condition

selection and not filter

Stage 1: selection

selection:
    CommandLine|contains:
        - ' --cpu-priority='
        - '--donate-level=0'
        - ' -o pool.'
        - ' --nicehash'
        - ' --algo=rx/0 '
        - 'stratum+tcp://'
        - 'stratum+udp://'
        - 'LS1kb25hdGUtbGV2ZWw9'
        - '0tZG9uYXRlLWxldmVsP'
        - 'tLWRvbmF0ZS1sZXZlbD'
        - 'c3RyYXR1bSt0Y3A6Ly'
        - 'N0cmF0dW0rdGNwOi8v'
        - 'zdHJhdHVtK3RjcDovL'
        - 'c3RyYXR1bSt1ZHA6Ly'
        - 'N0cmF0dW0rdWRwOi8v'
        - 'zdHJhdHVtK3VkcDovL'

Stage 2: not filter

filter:
    CommandLine|contains:
        - ' pool.c '
        - ' pool.o '
        - 'gcc -'

Exclusions

The rule actively suppresses these predicates.

FieldKindExcluded valuesSearch
CommandLinematch pool.c excludes:CommandLine field:"CommandLine" value:" pool.c "
CommandLinematch pool.o excludes:CommandLine field:"CommandLine" value:" pool.o "
CommandLinematchgcc -excludes:CommandLine field:"CommandLine" value:"gcc -"

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
CommandLinematch
  • --algo=rx/0 corpus 2 (sigma 2)
  • --cpu-priority= corpus 2 (sigma 2)
  • --nicehash corpus 2 (sigma 2)
  • -o pool. corpus 2 (sigma 2)
  • --donate-level=0 corpus 2 (sigma 2)
  • 0tZG9uYXRlLWxldmVsP corpus 2 (sigma 2)
  • LS1kb25hdGUtbGV2ZWw9 corpus 2 (sigma 2)
  • N0cmF0dW0rdGNwOi8v corpus 2 (sigma 2)
  • N0cmF0dW0rdWRwOi8v corpus 2 (sigma 2)
  • c3RyYXR1bSt0Y3A6Ly corpus 2 (sigma 2)
  • c3RyYXR1bSt1ZHA6Ly corpus 2 (sigma 2)
  • stratum+tcp:// corpus 4 (sigma 2, elastic 2)
  • stratum+udp:// corpus 2 (sigma 2)
  • tLWRvbmF0ZS1sZXZlbD corpus 2 (sigma 2)
  • zdHJhdHVtK3RjcDovL corpus 2 (sigma 2)
  • zdHJhdHVtK3VkcDovL corpus 2 (sigma 2)
field:"CommandLine" kind:match