KQL Search

Query Details

Rule : Crypto Mining Detection

Crypto Mining Detection

Query

DeviceProcessEvents
| where ProcessCommandLine has_any ( 
    "--cpu-priority=", 
    "--donate-level=0", 
    " -o pool.", 
    " --nicehash", 
    " --algo=rx/0 ", 
    "stratum+tcp://", 
    "stratum+udp://", 
    "sh -c /sbin/modprobe msr allow_writes=on", 
    "LS1kb25hdGUtbGV2ZWw9", 
    "0tZG9uYXRlLWxldmVsP", 
    "tLWRvbmF0ZS1sZXZlbD", 
    "c3RyYXR1bSt0Y3A6Ly", 
    "N0cmF0dW0rdGNwOi8v", 
    "zdHJhdHVtK3RjcDovL", 
    "c3RyYXR1bSt1ZHA6Ly", 
    "N0cmF0dW0rdWRwOi8v", 
    "zdHJhdHVtK3VkcDovL"
)

About this query

Rule : Crypto Mining Detection

Description

Detects potential cryptocurrency mining activities by monitoring process command lines for common indicators associated with mining software. Cryptocurrency mining on compromised systems can lead to degraded performance, increased power consumption, and potential hardware damage.

Detection Logic

  • Monitors process events for command lines containing common parameters and commands used by cryptocurrency mining software, such as:
    • --cpu-priority=
    • --donate-level=0
    • -o pool.
    • --nicehash
    • --algo=rx/0
    • stratum+tcp://
    • stratum+udp://
    • sh -c /sbin/modprobe msr allow_writes=on
    • Encoded strings associated with mining configurations and commands.

Tags

  • Cryptocurrency Mining
  • Process Events
  • Linux

Search Query

Explanation

This query looks for potential cryptocurrency mining activities by monitoring process command lines for specific indicators commonly associated with mining software. If any of these indicators are found in the command line, it suggests that the system may be compromised for mining purposes.