{"id":"a46c93b7-55ed-4d27-a41b-c259456c4746","title":"Linux Crypto Mining Pool Connections","description":"Detects process connections to a Monero crypto mining pool","author":"Florian Roth (Nextron Systems)","status":"stable","level":"high","date":"2021-10-26","modified":"","tags":["attack.impact","attack.t1496"],"technique_ids":["T1496"],"logsource":{"product":"linux","category":"network_connection"},"falsepositives":["Legitimate use of crypto miners"],"references":["https://www.poolwatch.io/coin/monero"],"source_path":"rules/linux/network_connection/net_connection_lnx_crypto_mining_indicators.yml","source_sha256":"3043ef5b176277a389aaf782fddda6aa15916fa0ef1657772cf079a5809ce976","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/network_connection/net_connection_lnx_crypto_mining_indicators.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Linux Crypto Mining Pool Connections\nid: a46c93b7-55ed-4d27-a41b-c259456c4746\nstatus: stable\ndescription: Detects process connections to a Monero crypto mining pool\nreferences:\n    - https://www.poolwatch.io/coin/monero\nauthor: Florian Roth (Nextron Systems)\ndate: 2021-10-26\ntags:\n    - attack.impact\n    - attack.t1496\nlogsource:\n    product: linux\n    category: network_connection\ndetection:\n    selection:\n        DestinationHostname:\n            - 'pool.minexmr.com'\n            - 'fr.minexmr.com'\n            - 'de.minexmr.com'\n            - 'sg.minexmr.com'\n            - 'ca.minexmr.com'\n            - 'us-west.minexmr.com'\n            - 'pool.supportxmr.com'\n            - 'mine.c3pool.com'\n            - 'xmr-eu1.nanopool.org'\n            - 'xmr-eu2.nanopool.org'\n            - 'xmr-us-east1.nanopool.org'\n            - 'xmr-us-west1.nanopool.org'\n            - 'xmr-asia1.nanopool.org'\n            - 'xmr-jp1.nanopool.org'\n            - 'xmr-au1.nanopool.org'\n            - 'xmr.2miners.com'\n            - 'xmr.hashcity.org'\n            - 'xmr.f2pool.com'\n            - 'xmrpool.eu'\n            - 'pool.hashvault.pro'\n            - 'moneroocean.stream'\n            - 'monerocean.stream'\n    condition: selection\nfalsepositives:\n    - Legitimate use of crypto miners\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1496","id":"T1496","name":"Resource Hijacking","page":"techniques/enterprise/T1496/"}],"data_path":"data/detection-rules/a46c93b7-55ed-4d27-a41b-c259456c4746.json","kind":"sigma"}