Linux Process Creation Crypto Miner Command-Line Indicators

ATT&CK techniques

Impact

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
- T1496Resource Hijacking

What it detects

This rule identifies Linux process creation events whose command line contains parameters and connection strings commonly seen in crypto miner tooling. Attackers can use these indicators to redirect compute resources to mining pools or disrupt host performance, so surfacing these patterns helps identify likely mining activity. It relies on telemetry that captures command-line arguments for newly created processes.

Reporting behind it

Related detections9 linkedT1496 — drag to rearrange

Malicious Hadooken Cryptominer Execution via Masqueraded Binaries (via process_creation)

Suspicious Lucifer Botnet Mining Pool Domain Resolution (via dns_query)

Suspicious Proxyjacking Service Resolution Observed in perfctl Campaign (via dns_query)

Malicious PureMiner Persistence Executable in AppData HResult Folder

Suspicious T-Rex CoinMiner Binaries in Windows NT Program Files Folder (via file_event)

Malicious Cryptocurrency Miner Execution (via process_creation)

Possible Cryptomining Beacon to c3pool Mining Domain

Malicious XMRig Cryptominer Execution with NiceHash Pool Arguments

Suspicious Payload Execution From systemd-private Temporary Directory on Linux

Linux Process Creation Crypto Miner Command-Line Indicators

Pivot detection · T1496 · 9 related

Changelog

v3

v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

linux-process-creation-crypto-miner-command-line-indicators-9069ea3c

title: Linux Process Creation Crypto Miner Command-Line Indicators
id: 095f6887-d716-406f-9e38-4f3af0a7aa2b
status: test
description: This rule identifies Linux process creation events whose command line contains parameters and connection strings commonly seen in crypto miner tooling. Attackers can use these indicators to redirect compute resources to mining pools or disrupt host performance, so surfacing these patterns helps identify likely mining activity. It relies on telemetry that captures command-line arguments for newly created processes.
references:
  - https://www.poolwatch.io/coin/monero
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_crypto_mining.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-10-26
modified: 2022-12-25
tags:
  - attack.impact
  - attack.t1496
logsource:
  product: linux
  category: process_creation
detection:
  selection:
    CommandLine|contains:
      - " --cpu-priority="
      - --donate-level=0
      - " -o pool."
      - " --nicehash"
      - " --algo=rx/0 "
      - stratum+tcp://
      - stratum+udp://
      - sh -c /sbin/modprobe msr allow_writes=on
      - LS1kb25hdGUtbGV2ZWw9
      - 0tZG9uYXRlLWxldmVsP
      - tLWRvbmF0ZS1sZXZlbD
      - c3RyYXR1bSt0Y3A6Ly
      - N0cmF0dW0rdGNwOi8v
      - zdHJhdHVtK3RjcDovL
      - c3RyYXR1bSt1ZHA6Ly
      - N0cmF0dW0rdWRwOi8v
      - zdHJhdHVtK3VkcDovL
  condition: selection
falsepositives:
  - Legitimate use of crypto miners
level: high
license: DRL-1.1
related:
  - id: 9069ea3c-b213-4c52-be13-86506a227ab1
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL