Linux Network Connections to Known Monero Mining Pool Hosts

title: Linux Network Connections to Known Monero Mining Pool Hosts
id: 8892915a-ceb0-45e8-b5b4-362e674aab53
status: stable
description: This rule identifies Linux processes that establish network connections to a set of known Monero mining pool hostnames. Connections to mining pools can indicate cryptomining activity, where attackers redirect CPU resources to external services. It relies on network connection telemetry, specifically the destination hostname observed for each outbound connection.
references:
  - https://www.poolwatch.io/coin/monero
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/network_connection/net_connection_lnx_crypto_mining_indicators.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-10-26
tags:
  - attack.impact
  - attack.t1496
logsource:
  product: linux
  category: network_connection
detection:
  selection:
    DestinationHostname:
      - pool.minexmr.com
      - fr.minexmr.com
      - de.minexmr.com
      - sg.minexmr.com
      - ca.minexmr.com
      - us-west.minexmr.com
      - pool.supportxmr.com
      - mine.c3pool.com
      - xmr-eu1.nanopool.org
      - xmr-eu2.nanopool.org
      - xmr-us-east1.nanopool.org
      - xmr-us-west1.nanopool.org
      - xmr-asia1.nanopool.org
      - xmr-jp1.nanopool.org
      - xmr-au1.nanopool.org
      - xmr.2miners.com
      - xmr.hashcity.org
      - xmr.f2pool.com
      - xmrpool.eu
      - pool.hashvault.pro
      - moneroocean.stream
      - monerocean.stream
  condition: selection
falsepositives:
  - Legitimate use of crypto miners
level: high
license: DRL-1.1
related:
  - id: a46c93b7-55ed-4d27-a41b-c259456c4746
    type: derived