huntrule

Suspicious Proxy User Agents for Crypto Miners (XMRig, CCMiner)

Flags proxy requests with User-Agent prefixes tied to XMRig or CCMiner crypto miners.

FreeUnreviewedSigmahighv1
title: Suspicious Proxy User Agents for Crypto Miners (XMRig, CCMiner)
id: 135e00a8-4ae8-45ca-9453-148edc1bbc56
status: test
description: This rule identifies proxy log entries whose User-Agent header begins with strings commonly used by crypto-mining software, specifically "XMRig " and "ccminer". Such user agents can indicate command-and-control or resource usage disguised as legitimate client traffic. The detection relies on telemetry from proxy logs with access to the HTTP User-Agent value.
references:
  - https://github.com/xmrig/xmrig/blob/da22b3e6c45825f3ac1f208255126cb8585cd4fc/src/base/kernel/Platform_win.cpp#L65
  - https://github.com/xmrig/xmrig/blob/427b6516e0550200c17ca28675118f0fffcc323f/src/version.h
  - https://github.com/SigmaHQ/sigma/blob/master/rules/web/proxy_generic/proxy_ua_cryptominer.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2019-10-21
modified: 2021-11-27
tags:
  - attack.command-and-control
  - attack.t1071.001
logsource:
  category: proxy
detection:
  selection:
    c-useragent|startswith:
      - "XMRig "
      - ccminer
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: fa935401-513b-467b-81f4-f9e77aa0dd78
    type: derived

What it detects

This rule identifies proxy log entries whose User-Agent header begins with strings commonly used by crypto-mining software, specifically "XMRig " and "ccminer". Such user agents can indicate command-and-control or resource usage disguised as legitimate client traffic. The detection relies on telemetry from proxy logs with access to the HTTP User-Agent value.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.