Detection rules › Splunk
Potential Cryptomining Commands (PowerShell)
Adversaries may leverage the resources of co-opted systems in order to solve resource intensive problems, which may impact system and/or hosted service availability. One common purpose for Resource Hijacking is to validate transactions of cryptocurrency networks and earn virtual currency. This use case detects common plaintext and base64 encoded commands for cryptomining activity.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Impact | T1496 Resource Hijacking |
References
Event coverage
| Provider | Event | Title |
|---|---|---|
| PowerShell | Event ID 4104 | Creating Scriptblock text (MessageNumber of MessageTotal). |
Rule body yaml
id: '19129.34174'
title: Potential Cryptomining Commands
description: Adversaries may leverage the resources of co-opted systems in order to
solve resource intensive problems, which may impact system and/or hosted service
availability. One common purpose for Resource Hijacking is to validate transactions
of cryptocurrency networks and earn virtual currency. This use case detects common
plaintext and base64 encoded commands for cryptomining activity.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4104) OR
"<EventID>4104<") ("--cpu-priority=" OR "--donate-level=" OR " -o pool." OR " --nicehash"
OR " --algo=" OR "stratum+tcp://" OR "stratum+udp://" OR "LS1kb25hdGUtbGV2ZWw9"
OR "0tZG9uYXRlLWxldmVsP" OR "tLWRvbmF0ZS1sZXZlbD" OR "c3RyYXR1bSt0Y3A6Ly" OR "N0cmF0dW0rdGNwOi8v"
OR "zdHJhdHVtK3RjcDovL" OR "c3RyYXR1bSt1ZHA6Ly" OR "N0cmF0dW0rdWRwOi8v" OR "zdHJhdHVtK3VkcDovL")
| regex process!="(?i)(pool\.(c|o))\s|gcc\s-" | table _time, host, user, process,
process_*, parent_process_name | bin span=1s | stats values(*) as * by _time, host '
techniques:
- impact:resource hijacking
technique_id:
- T1496
data_category:
- PowerShell logs
references:
- https://xmrig.com/docs/miner/command-line-options
- https://www.trendmicro.com/en_us/research/24/j/unmasking-prometei-a-deep-dive-into-our-mxdr-findings.html
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4104) OR "<EventID>4104<") ("--cpu-priority=" OR "--donate-level=" OR " -o pool." OR " --nicehash" OR " --algo=" OR "stratum+tcp://" OR "stratum+udp://" OR "LS1kb25hdGUtbGV2ZWw9" OR "0tZG9uYXRlLWxldmVsP" OR "tLWRvbmF0ZS1sZXZlbD" OR "c3RyYXR1bSt0Y3A6Ly" OR "N0cmF0dW0rdGNwOi8v" OR "zdHJhdHVtK3RjcDovL" OR "c3RyYXR1bSt1ZHA6Ly" OR "N0cmF0dW0rdWRwOi8v" OR "zdHJhdHVtK3VkcDovL")
Stage 2: regex
| regex process!="(?i)(pool\.(c|o))\s|gcc\s-"
Stage 3: table
| table _time, host, user, process, process_*, parent_process_name
Stage 4: bucket
| bin span=1s
Stage 5: stats
| stats values(*) as * by _time, host
Exclusions
Top-level NOT(...) conjuncts: predicates this rule actively suppresses.
| Field | Kind | Excluded values |
|---|---|---|
process | regex_match | "(?i)(pool.(c|o))\s, gcc\s-" |
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
EventCode | eq |
|
Search terms
Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.
| Stage | Term |
|---|---|
| 1 | TERM |
| 1 | "<EventID>4104<" |
| 1 | "--cpu-priority=" |
| 1 | "--donate-level=" |
| 1 | " -o pool." |
| 1 | " --nicehash" |
| 1 | " --algo=" |
| 1 | "stratum+tcp://" |
| 1 | "stratum+udp://" |
| 1 | "LS1kb25hdGUtbGV2ZWw9" |
| 1 | "0tZG9uYXRlLWxldmVsP" |
| 1 | "tLWRvbmF0ZS1sZXZlbD" |
| 1 | "c3RyYXR1bSt0Y3A6Ly" |
| 1 | "N0cmF0dW0rdGNwOi8v" |
| 1 | "zdHJhdHVtK3RjcDovL" |
| 1 | "c3RyYXR1bSt1ZHA6Ly" |
| 1 | "N0cmF0dW0rdWRwOi8v" |
| 1 | "zdHJhdHVtK3VkcDovL" |