Skip to content

Instantly share code, notes, and snippets.

@vicenteherrera

vicenteherrera/detect_crypto_miners_using_the_stratum_protocol.yaml

Created March 23, 2020 18:13
Show Gist options
  • Save vicenteherrera/a2d5185afe126bfa4a4e2b4f47b54670 to your computer and use it in GitHub Desktop.
Save vicenteherrera/a2d5185afe126bfa4a4e2b4f47b54670 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
detect_crypto_miners_using_the_stratum_protocol.yaml
- rule: Detect crypto miners using the Stratum protocol
desc: Miners typically specify the mining pool to connect to with a URI that begins with 'stratum+tcp'
condition: spawned_process and proc.cmdline contains "stratum+tcp"
output: Possible miner running (command=%proc.cmdline container=%container.info image=%container.image.repository)
priority: CRITICAL
tags: [process, mitre_execution]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment