{"id":"fa935401-513b-467b-81f4-f9e77aa0dd78","title":"Crypto Miner User Agent","description":"Detects suspicious user agent strings used by crypto miners in proxy logs","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2019-10-21","modified":"2021-11-27","tags":["attack.command-and-control","attack.t1071.001"],"technique_ids":["T1071.001"],"logsource":{"category":"proxy"},"falsepositives":["Unknown"],"references":["https://github.com/xmrig/xmrig/blob/da22b3e6c45825f3ac1f208255126cb8585cd4fc/src/base/kernel/Platform_win.cpp#L65","https://github.com/xmrig/xmrig/blob/427b6516e0550200c17ca28675118f0fffcc323f/src/version.h"],"source_path":"rules/web/proxy_generic/proxy_ua_cryptominer.yml","source_sha256":"a219bed6d5cb46d0db3a9e3d7fb8b9bb1e9b0772fe810379fae20300ca886e34","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/web/proxy_generic/proxy_ua_cryptominer.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Crypto Miner User Agent\nid: fa935401-513b-467b-81f4-f9e77aa0dd78\nstatus: test\ndescription: Detects suspicious user agent strings used by crypto miners in proxy logs\nreferences:\n    - https://github.com/xmrig/xmrig/blob/da22b3e6c45825f3ac1f208255126cb8585cd4fc/src/base/kernel/Platform_win.cpp#L65\n    - https://github.com/xmrig/xmrig/blob/427b6516e0550200c17ca28675118f0fffcc323f/src/version.h\nauthor: Florian Roth (Nextron Systems)\ndate: 2019-10-21\nmodified: 2021-11-27\ntags:\n    - attack.command-and-control\n    - attack.t1071.001\nlogsource:\n    category: proxy\ndetection:\n    selection:\n        c-useragent|startswith:\n        # XMRig\n            - 'XMRig '\n        # CCMiner\n            - 'ccminer'\n    condition: selection\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1071.001","id":"T1071.001","name":"Web Protocols","page":"techniques/enterprise/T1071.001/"}],"data_path":"data/detection-rules/fa935401-513b-467b-81f4-f9e77aa0dd78.json","kind":"sigma"}