{"id":"bf74135c-18e8-4a72-a926-0e4f47888c19","title":"DNS Events Related To Mining Pools","description":"Identifies clients that may be performing DNS lookups associated with common currency mining pools.","author":"Saw Winn Naung, Azure-Sentinel, @neu5ron","status":"test","level":"low","date":"2021-08-19","modified":"2022-07-07","tags":["attack.execution","attack.t1569.002","attack.impact","attack.t1496"],"technique_ids":["T1496","T1569.002"],"logsource":{"service":"dns","product":"zeek"},"falsepositives":["A DNS lookup does not necessarily  mean a successful attempt, verify a) if there was a response using the zeek answers field, if there was then verify the connections (conn.log) to those IPs. b) verify if HTTP, SSL, or TLS activity to the domain that was queried. http.log field is 'host' and ssl/tls is 'server_name'."],"references":["https://github.com/Azure/Azure-Sentinel/blob/fa0411f9424b6c47b4d5a20165e4f1b168c1f103/Detections/ASimDNS/imDNS_Miners.yaml"],"source_path":"rules/network/zeek/zeek_dns_mining_pools.yml","source_sha256":"93c722904e9edaa9b7a524f2ffa45b78a79971379791e993a13f20bc5548ccb3","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/network/zeek/zeek_dns_mining_pools.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: DNS Events Related To Mining Pools\nid: bf74135c-18e8-4a72-a926-0e4f47888c19\nstatus: test\ndescription: Identifies clients that may be performing DNS lookups associated with common currency mining pools.\nreferences:\n    - https://github.com/Azure/Azure-Sentinel/blob/fa0411f9424b6c47b4d5a20165e4f1b168c1f103/Detections/ASimDNS/imDNS_Miners.yaml\nauthor: Saw Winn Naung, Azure-Sentinel, @neu5ron\ndate: 2021-08-19\nmodified: 2022-07-07\ntags:\n    - attack.execution\n    - attack.t1569.002\n    - attack.impact\n    - attack.t1496\nlogsource:\n    service: dns\n    product: zeek\ndetection:\n    selection:\n        query|endswith:\n            - 'monerohash.com'\n            - 'do-dear.com'\n            - 'xmrminerpro.com'\n            - 'secumine.net'\n            - 'xmrpool.com'\n            - 'minexmr.org'\n            - 'hashanywhere.com'\n            - 'xmrget.com'\n            - 'mininglottery.eu'\n            - 'minergate.com'\n            - 'moriaxmr.com'\n            - 'multipooler.com'\n            - 'moneropools.com'\n            - 'xmrpool.eu'\n            - 'coolmining.club'\n            - 'supportxmr.com'\n            - 'minexmr.com'\n            - 'hashvault.pro'\n            - 'xmrpool.net'\n            - 'crypto-pool.fr'\n            - 'xmr.pt'\n            - 'miner.rocks'\n            - 'walpool.com'\n            - 'herominers.com'\n            - 'gntl.co.uk'\n            - 'semipool.com'\n            - 'coinfoundry.org'\n            - 'cryptoknight.cc'\n            - 'fairhash.org'\n            - 'baikalmine.com'\n            - 'tubepool.xyz'\n            - 'fairpool.xyz'\n            - 'asiapool.io'\n            - 'coinpoolit.webhop.me'\n            - 'nanopool.org'\n            - 'moneropool.com'\n            - 'miner.center'\n            - 'prohash.net'\n            - 'poolto.be'\n            - 'cryptoescrow.eu'\n            - 'monerominers.net'\n            - 'cryptonotepool.org'\n            - 'extrmepool.org'\n            - 'webcoin.me'\n            - 'kippo.eu'\n            - 'hashinvest.ws'\n            - 'monero.farm'\n            - 'linux-repository-updates.com'\n            - '1gh.com'\n            - 'dwarfpool.com'\n            - 'hash-to-coins.com'\n            - 'pool-proxy.com'\n            - 'hashfor.cash'\n            - 'fairpool.cloud'\n            - 'litecoinpool.org'\n            - 'mineshaft.ml'\n            - 'abcxyz.stream'\n            - 'moneropool.ru'\n            - 'cryptonotepool.org.uk'\n            - 'extremepool.org'\n            - 'extremehash.com'\n            - 'hashinvest.net'\n            - 'unipool.pro'\n            - 'crypto-pools.org'\n            - 'monero.net'\n            - 'backup-pool.com'\n            - 'mooo.com' # Dynamic DNS, may want to exclude\n            - 'freeyy.me'\n            - 'cryptonight.net'\n            - 'shscrypto.net'\n    exclude_answers:\n        answers:\n            - '127.0.0.1'\n            - '0.0.0.0'\n    exclude_rejected:\n        rejected: 'true'\n    condition: selection and not 1 of exclude_*\nfalsepositives:\n    - A DNS lookup does not necessarily  mean a successful attempt, verify a) if there was a response using the zeek answers field, if there was then verify the connections (conn.log) to those IPs. b) verify if HTTP, SSL, or TLS activity to the domain that was queried. http.log field is 'host' and ssl/tls is 'server_name'.\nlevel: low\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1496","id":"T1496","name":"Resource Hijacking","page":"techniques/enterprise/T1496/"},{"key":"enterprise/T1569.002","id":"T1569.002","name":"Service Execution","page":"techniques/enterprise/T1569.002/"}],"data_path":"data/detection-rules/bf74135c-18e8-4a72-a926-0e4f47888c19.json","kind":"sigma"}