Linux auditd: Processes using --cpu-priority command-line option

title: "Linux auditd: Processes using --cpu-priority command-line option"
id: 07a7ce5b-6570-4878-9c84-5086e0a231c3
status: test
description: This rule flags Linux command lines where the process arguments start with the --cpu-priority flag. Attackers and cryptocurrency miners may use this parameter to influence CPU scheduling and maximize resource usage on the host. The detection relies on auditd telemetry capturing the executed command line and matches only when the argument begins with --cpu-priority.
references:
  - https://xmrig.com/docs/miner/command-line-options
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/execve/lnx_auditd_coinminer.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-10-09
modified: 2022-12-25
tags:
  - attack.privilege-escalation
  - attack.t1068
logsource:
  product: linux
  service: auditd
detection:
  cmd1:
    a1|startswith: --cpu-priority
  cmd2:
    a2|startswith: --cpu-priority
  cmd3:
    a3|startswith: --cpu-priority
  cmd4:
    a4|startswith: --cpu-priority
  cmd5:
    a5|startswith: --cpu-priority
  cmd6:
    a6|startswith: --cpu-priority
  cmd7:
    a7|startswith: --cpu-priority
  condition: 1 of cmd*
falsepositives:
  - Other tools that use a --cpu-priority flag
level: critical
license: DRL-1.1
related:
  - id: 071d5e5a-9cef-47ec-bc4e-a42e34d8d0ed
    type: derived