{"id":"fa5b1358-b040-4403-9868-15f7d9ab6329","title":"Network Communication With Crypto Mining Pool","description":"Detects initiated network connections to crypto mining pools","author":"Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)","status":"stable","level":"high","date":"2021-10-26","modified":"2024-01-19","tags":["attack.impact","attack.t1496"],"technique_ids":["T1496"],"logsource":{"category":"network_connection","product":"windows"},"falsepositives":["Unlikely"],"references":["https://www.poolwatch.io/coin/monero","https://github.com/stamparm/maltrail/blob/3ea70459b9559134449423c0a7d8b965ac5c40ea/trails/static/suspicious/crypto_mining.txt","https://www.virustotal.com/gui/search/behaviour_network%253A*.miningocean.org/files"],"source_path":"rules/windows/network_connection/net_connection_win_domain_crypto_mining_pools.yml","source_sha256":"6a2be3cab1b7d4dea0f719c6dd0b7bab51fa329af08ce19fe35c9494345046b0","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/network_connection/net_connection_win_domain_crypto_mining_pools.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Network Communication With Crypto Mining Pool\nid: fa5b1358-b040-4403-9868-15f7d9ab6329\nstatus: stable\ndescription: Detects initiated network connections to crypto mining pools\nreferences:\n    - https://www.poolwatch.io/coin/monero\n    - https://github.com/stamparm/maltrail/blob/3ea70459b9559134449423c0a7d8b965ac5c40ea/trails/static/suspicious/crypto_mining.txt\n    - https://www.virustotal.com/gui/search/behaviour_network%253A*.miningocean.org/files\nauthor: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)\ndate: 2021-10-26\nmodified: 2024-01-19\ntags:\n    - attack.impact\n    - attack.t1496\nlogsource:\n    category: network_connection\n    product: windows\ndetection:\n    selection:\n        DestinationHostname:\n            - 'alimabi.cn'\n            - 'ap.luckpool.net'\n            - 'bcn.pool.minergate.com'\n            - 'bcn.vip.pool.minergate.com'\n            - 'bohemianpool.com'\n            - 'ca-aipg.miningocean.org'\n            - 'ca-dynex.miningocean.org'\n            - 'ca-neurai.miningocean.org'\n            - 'ca-qrl.miningocean.org'\n            - 'ca-upx.miningocean.org'\n            - 'ca-zephyr.miningocean.org'\n            - 'ca.minexmr.com'\n            - 'ca.monero.herominers.com'\n            - 'cbd.monerpool.org'\n            - 'cbdv2.monerpool.org'\n            - 'cryptmonero.com'\n            - 'crypto-pool.fr'\n            - 'crypto-pool.info'\n            - 'cryptonight-hub.miningpoolhub.com'\n            - 'd1pool.ddns.net'\n            - 'd5pool.us'\n            - 'daili01.monerpool.org'\n            - 'de-aipg.miningocean.org'\n            - 'de-dynex.miningocean.org'\n            - 'de-zephyr.miningocean.org'\n            - 'de.minexmr.com'\n            - 'dl.nbminer.com'\n            - 'donate.graef.in'\n            - 'donate.ssl.xmrig.com'\n            - 'donate.v2.xmrig.com'\n            - 'donate.xmrig.com'\n            - 'donate2.graef.in'\n            - 'drill.moneroworld.com'\n            - 'dwarfpool.com'\n            - 'emercoin.com'\n            - 'emercoin.net'\n            - 'emergate.net'\n            - 'ethereumpool.co'\n            - 'eu.luckpool.net'\n            - 'eu.minerpool.pw'\n            - 'fcn-xmr.pool.minergate.com'\n            - 'fee.xmrig.com'\n            - 'fr-aipg.miningocean.org'\n            - 'fr-dynex.miningocean.org'\n            - 'fr-neurai.miningocean.org'\n            - 'fr-qrl.miningocean.org'\n            - 'fr-upx.miningocean.org'\n            - 'fr-zephyr.miningocean.org'\n            - 'fr.minexmr.com'\n            - 'hellominer.com'\n            - 'herominers.com'\n            - 'hk-aipg.miningocean.org'\n            - 'hk-dynex.miningocean.org'\n            - 'hk-neurai.miningocean.org'\n            - 'hk-qrl.miningocean.org'\n            - 'hk-upx.miningocean.org'\n            - 'hk-zephyr.miningocean.org'\n            - 'huadong1-aeon.ppxxmr.com'\n            - 'iwanttoearn.money'\n            - 'jw-js1.ppxxmr.com'\n            - 'koto-pool.work'\n            - 'lhr.nbminer.com'\n            - 'lhr3.nbminer.com'\n            - 'linux.monerpool.org'\n            - 'lokiturtle.herominers.com'\n            - 'luckpool.net'\n            - 'masari.miner.rocks'\n            - 'mine.c3pool.com'\n            - 'mine.moneropool.com'\n            - 'mine.ppxxmr.com'\n            - 'mine.zpool.ca'\n            - 'mine1.ppxxmr.com'\n            - 'minemonero.gq'\n            - 'miner.ppxxmr.com'\n            - 'miner.rocks'\n            - 'minercircle.com'\n            - 'minergate.com'\n            - 'minerpool.pw'\n            - 'minerrocks.com'\n            - 'miners.pro'\n            - 'minerxmr.ru'\n            - 'minexmr.cn'\n            - 'minexmr.com'\n            - 'mining-help.ru'\n            - 'miningpoolhub.com'\n            - 'mixpools.org'\n            - 'moner.monerpool.org'\n            - 'moner1min.monerpool.org'\n            - 'monero-master.crypto-pool.fr'\n            - 'monero.crypto-pool.fr'\n            - 'monero.hashvault.pro'\n            - 'monero.herominers.com'\n            - 'monero.lindon-pool.win'\n            - 'monero.miners.pro'\n            - 'monero.riefly.id'\n            - 'monero.us.to'\n            - 'monerocean.stream'\n            - 'monerogb.com'\n            - 'monerohash.com'\n            - 'moneroocean.stream'\n            - 'moneropool.com'\n            - 'moneropool.nl'\n            - 'monerorx.com'\n            - 'monerpool.org'\n            - 'moriaxmr.com'\n            - 'mro.pool.minergate.com'\n            - 'multipool.us'\n            - 'myxmr.pw'\n            - 'na.luckpool.net'\n            - 'nanopool.org'\n            - 'nbminer.com'\n            - 'node3.luckpool.net'\n            - 'noobxmr.com'\n            - 'pangolinminer.comgandalph3000.com'\n            - 'pool.4i7i.com'\n            - 'pool.armornetwork.org'\n            - 'pool.cortins.tk'\n            - 'pool.gntl.co.uk'\n            - 'pool.hashvault.pro'\n            - 'pool.minergate.com'\n            - 'pool.minexmr.com'\n            - 'pool.monero.hashvault.pro'\n            - 'pool.ppxxmr.com'\n            - 'pool.somec.cc'\n            - 'pool.support'\n            - 'pool.supportxmr.com'\n            - 'pool.usa-138.com'\n            - 'pool.xmr.pt'\n            - 'pool.xmrfast.com'\n            - 'pool2.armornetwork.org'\n            - 'poolchange.ppxxmr.com'\n            - 'pooldd.com'\n            - 'poolmining.org'\n            - 'poolto.be'\n            - 'ppxvip1.ppxxmr.com'\n            - 'ppxxmr.com'\n            - 'prohash.net'\n            - 'r.twotouchauthentication.online'\n            - 'randomx.xmrig.com'\n            - 'ratchetmining.com'\n            - 'seed.emercoin.com'\n            - 'seed.emercoin.net'\n            - 'seed.emergate.net'\n            - 'seed1.joulecoin.org'\n            - 'seed2.joulecoin.org'\n            - 'seed3.joulecoin.org'\n            - 'seed4.joulecoin.org'\n            - 'seed5.joulecoin.org'\n            - 'seed6.joulecoin.org'\n            - 'seed7.joulecoin.org'\n            - 'seed8.joulecoin.org'\n            - 'sg-aipg.miningocean.org'\n            - 'sg-dynex.miningocean.org'\n            - 'sg-neurai.miningocean.org'\n            - 'sg-qrl.miningocean.org'\n            - 'sg-upx.miningocean.org'\n            - 'sg-zephyr.miningocean.org'\n            - 'sg.minexmr.com'\n            - 'sheepman.mine.bz'\n            - 'siamining.com'\n            - 'sumokoin.minerrocks.com'\n            - 'supportxmr.com'\n            - 'suprnova.cc'\n            - 'teracycle.net'\n            - 'trtl.cnpool.cc'\n            - 'trtl.pool.mine2gether.com'\n            - 'turtle.miner.rocks'\n            - 'us-aipg.miningocean.org'\n            - 'us-dynex.miningocean.org'\n            - 'us-neurai.miningocean.org'\n            - 'us-west.minexmr.com'\n            - 'us-zephyr.miningocean.org'\n            - 'usxmrpool.com'\n            - 'viaxmr.com'\n            - 'webservicepag.webhop.net'\n            - 'xiazai.monerpool.org'\n            - 'xiazai1.monerpool.org'\n            - 'xmc.pool.minergate.com'\n            - 'xmo.pool.minergate.com'\n            - 'xmr-asia1.nanopool.org'\n            - 'xmr-au1.nanopool.org'\n            - 'xmr-eu1.nanopool.org'\n            - 'xmr-eu2.nanopool.org'\n            - 'xmr-jp1.nanopool.org'\n            - 'xmr-us-east1.nanopool.org'\n            - 'xmr-us-west1.nanopool.org'\n            - 'xmr-us.suprnova.cc'\n            - 'xmr-usa.dwarfpool.com'\n            - 'xmr.2miners.com'\n            - 'xmr.5b6b7b.ru'\n            - 'xmr.alimabi.cn'\n            - 'xmr.bohemianpool.com'\n            - 'xmr.crypto-pool.fr'\n            - 'xmr.crypto-pool.info'\n            - 'xmr.f2pool.com'\n            - 'xmr.hashcity.org'\n            - 'xmr.hex7e4.ru'\n            - 'xmr.ip28.net'\n            - 'xmr.monerpool.org'\n            - 'xmr.mypool.online'\n            - 'xmr.nanopool.org'\n            - 'xmr.pool.gntl.co.uk'\n            - 'xmr.pool.minergate.com'\n            - 'xmr.poolto.be'\n            - 'xmr.ppxxmr.com'\n            - 'xmr.prohash.net'\n            - 'xmr.simka.pw'\n            - 'xmr.somec.cc'\n            - 'xmr.suprnova.cc'\n            - 'xmr.usa-138.com'\n            - 'xmr.vip.pool.minergate.com'\n            - 'xmr1min.monerpool.org'\n            - 'xmrf.520fjh.org'\n            - 'xmrf.fjhan.club'\n            - 'xmrfast.com'\n            - 'xmrigcc.graef.in'\n            - 'xmrminer.cc'\n            - 'xmrpool.de'\n            - 'xmrpool.eu'\n            - 'xmrpool.me'\n            - 'xmrpool.net'\n            - 'xmrpool.xyz'\n            - 'xx11m.monerpool.org'\n            - 'xx11mv2.monerpool.org'\n            - 'xxx.hex7e4.ru'\n            - 'zarabotaibitok.ru'\n            - 'zer0day.ru'\n    condition: selection\nfalsepositives:\n    - Unlikely\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1496","id":"T1496","name":"Resource Hijacking","page":"techniques/enterprise/T1496/"}],"data_path":"data/detection-rules/fa5b1358-b040-4403-9868-15f7d9ab6329.json","kind":"sigma"}