Linux Process Creation Crypto Miner Command-Line Indicators

Alerts on Linux process executions with command-line strings typical of crypto mining pools, stratum endpoints, and miner options.

FreeUnreviewedSigmahighv1

linux-process-creation-crypto-miner-command-line-indicators-9069ea3c

title: Linux Process Creation Crypto Miner Command-Line Indicators
id: 095f6887-d716-406f-9e38-4f3af0a7aa2b
status: test
description: This rule flags Linux process creation events whose command lines contain strings and parameters commonly associated with crypto mining software, including pool/stratum endpoints and miner tuning flags. Attackers may use these indicators to launch miners that redirect system resources for financial gain. Detection relies on process creation telemetry with access to the full command line, matching both plain-text and base64-encoded miner parameters.
references:
  - https://www.poolwatch.io/coin/monero
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_crypto_mining.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-10-26
modified: 2022-12-25
tags:
  - attack.impact
  - attack.t1496
logsource:
  product: linux
  category: process_creation
detection:
  selection:
    CommandLine|contains:
      - " --cpu-priority="
      - --donate-level=0
      - " -o pool."
      - " --nicehash"
      - " --algo=rx/0 "
      - stratum+tcp://
      - stratum+udp://
      - sh -c /sbin/modprobe msr allow_writes=on
      - LS1kb25hdGUtbGV2ZWw9
      - 0tZG9uYXRlLWxldmVsP
      - tLWRvbmF0ZS1sZXZlbD
      - c3RyYXR1bSt0Y3A6Ly
      - N0cmF0dW0rdGNwOi8v
      - zdHJhdHVtK3RjcDovL
      - c3RyYXR1bSt1ZHA6Ly
      - N0cmF0dW0rdWRwOi8v
      - zdHJhdHVtK3VkcDovL
  condition: selection
falsepositives:
  - Legitimate use of crypto miners
level: high
license: DRL-1.1
related:
  - id: 9069ea3c-b213-4c52-be13-86506a227ab1
    type: derived

What it detects

This rule flags Linux process creation events whose command lines contain strings and parameters commonly associated with crypto mining software, including pool/stratum endpoints and miner tuning flags. Attackers may use these indicators to launch miners that redirect system resources for financial gain. Detection relies on process creation telemetry with access to the full command line, matching both plain-text and base64-encoded miner parameters.

Known false positives

Legitimate use of crypto miners

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.