{"id":"66c3b204-9f88-4d0a-a7f7-8a57d521ca55","title":"Potential Crypto Mining Activity","description":"Detects command line parameters or strings often used by crypto miners","author":"Florian Roth (Nextron Systems)","status":"stable","level":"high","date":"2021-10-26","modified":"2023-02-13","tags":["attack.impact","attack.t1496"],"technique_ids":["T1496"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Legitimate use of crypto miners","Some build frameworks"],"references":["https://www.poolwatch.io/coin/monero"],"source_path":"rules/windows/process_creation/proc_creation_win_susp_crypto_mining_monero.yml","source_sha256":"ab0e5bde99c33ca00ac32a3352a28caf821cd66a5a9e4e6972d82388b20636ab","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_susp_crypto_mining_monero.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Potential Crypto Mining Activity\nid: 66c3b204-9f88-4d0a-a7f7-8a57d521ca55\nstatus: stable\ndescription: Detects command line parameters or strings often used by crypto miners\nreferences:\n    - https://www.poolwatch.io/coin/monero\nauthor: Florian Roth (Nextron Systems)\ndate: 2021-10-26\nmodified: 2023-02-13\ntags:\n    - attack.impact\n    - attack.t1496\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        CommandLine|contains:\n            - ' --cpu-priority='\n            - '--donate-level=0'\n            - ' -o pool.'\n            - ' --nicehash'\n            - ' --algo=rx/0 '\n            - 'stratum+tcp://'\n            - 'stratum+udp://'\n            # base64 encoded: --donate-level=\n            - 'LS1kb25hdGUtbGV2ZWw9'\n            - '0tZG9uYXRlLWxldmVsP'\n            - 'tLWRvbmF0ZS1sZXZlbD'\n            # base64 encoded: stratum+tcp:// and stratum+udp://\n            - 'c3RyYXR1bSt0Y3A6Ly'\n            - 'N0cmF0dW0rdGNwOi8v'\n            - 'zdHJhdHVtK3RjcDovL'\n            - 'c3RyYXR1bSt1ZHA6Ly'\n            - 'N0cmF0dW0rdWRwOi8v'\n            - 'zdHJhdHVtK3VkcDovL'\n    filter:\n        CommandLine|contains:\n            - ' pool.c '\n            - ' pool.o '\n            - 'gcc -'\n    condition: selection and not filter\nfalsepositives:\n    - Legitimate use of crypto miners\n    - Some build frameworks\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1496","id":"T1496","name":"Resource Hijacking","page":"techniques/enterprise/T1496/"}],"data_path":"data/detection-rules/66c3b204-9f88-4d0a-a7f7-8a57d521ca55.json","kind":"sigma"}