Skip to content

Instantly share code, notes, and snippets.

@vicenteherrera

vicenteherrera/detect_outbound_connections_to_common_miner_pool_ports.yaml

Created March 23, 2020 18:15
Show Gist options
  • Save vicenteherrera/55576b4011c4b254f08087917141debf to your computer and use it in GitHub Desktop.
Save vicenteherrera/55576b4011c4b254f08087917141debf to your computer and use it in GitHub Desktop.
Download ZIP
Raw
detect_outbound_connections_to_common_miner_pool_ports.yaml
- rule: Detect outbound connections to common miner pool ports
desc: Miners typically connect to miner pools on common ports.
condition: net_miner_pool
output: Outbound connection to IP/Port flagged by cryptoioc.ch (command=%proc.cmdline port=%fd.rport ip=%fd.rip container=%container.info image=%container.image.repository)
priority: CRITICAL
tags: [network, mitre_execution]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment