Suspicious DNS Lookups for Monero Mining Pool Domains

title: Suspicious DNS Lookups for Monero Mining Pool Domains
id: 8bb20fe6-0641-464d-affd-6a21cde67d7c
status: stable
description: This rule flags DNS queries containing known Monero mining pool and worker-related domain names. Attackers commonly use these destinations to route mining pool communications, which can indicate unauthorized cryptomining activity. The detection relies on DNS telemetry capturing query strings that match the listed pool domains.
references:
  - https://www.nextron-systems.com/2021/10/24/monero-mining-pool-fqdns/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/network/dns/net_dns_pua_cryptocoin_mining_xmr.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-10-24
tags:
  - attack.impact
  - attack.t1496
  - attack.exfiltration
  - attack.t1567
logsource:
  category: dns
detection:
  selection:
    query|contains:
      - pool.minexmr.com
      - fr.minexmr.com
      - de.minexmr.com
      - sg.minexmr.com
      - ca.minexmr.com
      - us-west.minexmr.com
      - pool.supportxmr.com
      - mine.c3pool.com
      - xmr-eu1.nanopool.org
      - xmr-eu2.nanopool.org
      - xmr-us-east1.nanopool.org
      - xmr-us-west1.nanopool.org
      - xmr-asia1.nanopool.org
      - xmr-jp1.nanopool.org
      - xmr-au1.nanopool.org
      - xmr.2miners.com
      - xmr.hashcity.org
      - xmr.f2pool.com
      - xmrpool.eu
      - pool.hashvault.pro
  condition: selection
falsepositives:
  - Legitimate crypto coin mining
level: high
license: DRL-1.1
related:
  - id: b593fd50-7335-4682-a36c-4edcb68e4641
    type: derived