AN1489
Analytic 1489
Windows
Sustained execution of resource-intensive processes (e.g., cryptocurrency miners), often launched via scheduled tasks, WMI, or PowerShell. These processes frequently establish persistent external connections and attempt to evade detection using masqueraded or renamed binaries.
WinEventLog:Sysmon
EventCode=1
WinEventLog:Sysmon
EventCode=3, 22
WinEventLog:Security
EventCode=4698
[Image]
The executable name of the miner or wrapper—can vary across campaigns.
[DestinationIP]
May differ depending on the mining pool or proxy server.
[ParentProcessName]
Useful for filtering known-good automation vs malicious task runners.
AN1490
Analytic 1490
Linux
Unusual long-running processes consuming high CPU cycles (e.g., via 'top' or 'ps') initiated via cron, shell scripts, or Docker. Connections to known mining pools or DNS over HTTPS usage as evasion.
auditd:SYSCALL
execve
NSM:Flow
Outbound connection to mining pool port (3333, 4444, 5555)
linux:cron
Scheduled execution of unknown or unusual script/binary
[CommandLine]
The miner's execution path and options may vary by campaign.
[CPUThreshold]
Environment-specific definition of anomalous CPU usage.
AN1491
Analytic 1491
macOS
Persistent or background daemons (e.g., plist or launchd jobs) spawning high-CPU processes like xmrig or cpuminer. Outbound encrypted traffic to IPs/domains commonly used by mining proxies.
macos:unifiedlog
launchd or cron spawning mining binaries
macos:unifiedlog
Persistent outbound connections with consistent periodicity
[launchd.plist_label]
May be disguised with benign-looking names.
[DestinationDomain]
Varying mining pool or obfuscated destination.
AN1492
Analytic 1492
Containers
Ephemeral or unauthorized container instantiation using public images (e.g., from DockerHub) that initiate high CPU usage shortly after startup. Often scheduled via Kubernetes or Docker socket abuse.
containerd:events
create
auditd:SYSCALL
execve
NSM:Flow
Outbound traffic to mining pool upon container launch
[ImageSource]
May vary depending on where the image is pulled from (registry or custom URL).
[Namespace]
Helps differentiate attacker-created namespaces.
AN1493
Analytic 1493
IaaS
Unauthorized instance creation in unmonitored or unused regions. Burst of compute-intensive jobs in spot instances or sudden spike in resource usage in legitimate VMs.
AWS:CloudTrail
RunInstances
AWS:CloudWatch
Unusual CPU burst or metric anomalies
[Region]
Adversaries may deploy resources in rarely used or misconfigured regions.
[TagKey]
Used to evade detection with benign-looking tags or names.