Linux Process Network Connections to Crypto Mining Pool Hosts

ATT&CK techniques

Impact

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
- T1496Resource Hijacking

What it detects

This rule flags Linux processes that establish network connections to known cryptocurrency mining pool hostnames, including Monero-related pools. Such connections are often used by unauthorized miners to retrieve work and submit mined shares, making outbound traffic to these domains a useful indicator of potential resource abuse. It relies on telemetry that records process-level network connections with a destination hostname match against the listed pool domains.

Reporting behind it

Related detections9 linkedT1496 — drag to rearrange

Malicious Hadooken Cryptominer Execution via Masqueraded Binaries (via process_creation)

Suspicious Lucifer Botnet Mining Pool Domain Resolution (via dns_query)

Suspicious Proxyjacking Service Resolution Observed in perfctl Campaign (via dns_query)

Malicious PureMiner Persistence Executable in AppData HResult Folder

Suspicious T-Rex CoinMiner Binaries in Windows NT Program Files Folder (via file_event)

Malicious Cryptocurrency Miner Execution (via process_creation)

Possible Cryptomining Beacon to c3pool Mining Domain

Malicious XMRig Cryptominer Execution with NiceHash Pool Arguments

Suspicious Payload Execution From systemd-private Temporary Directory on Linux

Linux Process Network Connections to Crypto Mining Pool Hosts

Pivot detection · T1496 · 9 related

Changelog

v3

v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

linux-network-connections-to-known-monero-mining-pool-hosts-a46c93b7

title: Linux Process Network Connections to Crypto Mining Pool Hosts
id: 8892915a-ceb0-45e8-b5b4-362e674aab53
status: stable
description: This rule flags Linux processes that establish network connections to known cryptocurrency mining pool hostnames, including Monero-related pools. Such connections are often used by unauthorized miners to retrieve work and submit mined shares, making outbound traffic to these domains a useful indicator of potential resource abuse. It relies on telemetry that records process-level network connections with a destination hostname match against the listed pool domains.
references:
  - https://www.poolwatch.io/coin/monero
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/network_connection/net_connection_lnx_crypto_mining_indicators.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-10-26
tags:
  - attack.impact
  - attack.t1496
logsource:
  product: linux
  category: network_connection
detection:
  selection:
    DestinationHostname:
      - pool.minexmr.com
      - fr.minexmr.com
      - de.minexmr.com
      - sg.minexmr.com
      - ca.minexmr.com
      - us-west.minexmr.com
      - pool.supportxmr.com
      - mine.c3pool.com
      - xmr-eu1.nanopool.org
      - xmr-eu2.nanopool.org
      - xmr-us-east1.nanopool.org
      - xmr-us-west1.nanopool.org
      - xmr-asia1.nanopool.org
      - xmr-jp1.nanopool.org
      - xmr-au1.nanopool.org
      - xmr.2miners.com
      - xmr.hashcity.org
      - xmr.f2pool.com
      - xmrpool.eu
      - pool.hashvault.pro
      - moneroocean.stream
      - monerocean.stream
  condition: selection
falsepositives:
  - Legitimate use of crypto miners
level: high
license: DRL-1.1
related:
  - id: a46c93b7-55ed-4d27-a41b-c259456c4746
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL