Windows Network Connections to Known Crypto Mining Pool Hostnames
Flags Windows hosts making outbound connections to known cryptocurrency mining pool domains.
FreeUnreviewedSigmahighv1
windows-network-connections-to-known-crypto-mining-pool-hostnames-fa5b1358
title: Windows Network Connections to Known Crypto Mining Pool Hostnames
id: 1c9006f3-4c48-41da-9e01-cda1ba4f6011
status: stable
description: This rule identifies Windows systems initiating network connections to a hardcoded set of crypto mining pool hostnames. Such connections are commonly associated with cryptocurrency mining activity and can indicate miner malware or unauthorized use of the host for mining. The detection relies on network_connection telemetry that records the destination hostname of outbound sessions.
references:
- https://www.poolwatch.io/coin/monero
- https://github.com/stamparm/maltrail/blob/da082537e0f37b9dece3a6998583e43bb5709c4e/trails/static/suspicious/crypto_mining.txt
- https://www.virustotal.com/gui/search/behaviour_network%253A*.miningocean.org/files
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_domain_crypto_mining_pools.yml
author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2021-10-26
modified: 2026-07-24
tags:
- attack.impact
- attack.t1496
logsource:
category: network_connection
product: windows
detection:
selection:
DestinationHostname:
- aeon-pool.com
- alimabi.cn
- ap.luckpool.net
- api.fastpool.xyz
- auto.c3pool.org
- awgoaigartnj-xmr.com
- backup.fastpool.xyz
- bcn.pool.minergate.com
- bcn.vip.pool.minergate.com
- bizxmr.cc
- bmpool.org
- bohemianpool.com
- byw.dscloud.me
- c3.wptask.cyou
- c3pool.org
- ca-aipg.miningocean.org
- ca-dynex.miningocean.org
- ca-neurai.miningocean.org
- ca-qrl.miningocean.org
- ca-upx.miningocean.org
- ca-zephyr.miningocean.org
- ca.minexmr.com
- ca.monero.herominers.com
- cbd.monerpool.org
- cbdv2.monerpool.org
- community-pools.mysrv.cloud
- covid19crypto.com
- cryptmonero.com
- crypto-pool.fr
- crypto-pool.info
- cryptominded.com
- cryptonight-hub.miningpoolhub.com
- d1pool.ddns.net
- d5pool.us
- daili01.monerpool.org
- de-aipg.miningocean.org
- de-dynex.miningocean.org
- de-zephyr.miningocean.org
- de.minexmr.com
- de.moneroocean.stream
- de.salvium.herominers.com
- de.zephyr.herominers.com
- dl.nbminer.com
- donate.graef.in
- donate.ssl.xmrig.com
- donate.v2.xmrig.com
- donate.xmrig.com
- donate2.graef.in
- drill.moneroworld.com
- dwarfpool.com
- emercoin.com
- emercoin.net
- emergate.net
- ethereumpool.co
- eu.luckpool.net
- eu.minerpool.pw
- f2pool.com
- fastpool.xyz
- fcn-xmr.pool.minergate.com
- fee.xmrig.com
- fi.moneroocean.stream
- fr-aipg.miningocean.org
- fr-dynex.miningocean.org
- fr-neurai.miningocean.org
- fr-qrl.miningocean.org
- fr-tarirx.luckypool.io
- fr-upx.miningocean.org
- fr-zephyr.miningocean.org
- fr.minexmr.com
- fr.moneroocean.stream
- friendspool.club
- ftp.fastpool.xyz
- gandalph3000.com
- googleminer.com
- grin.2miners.com
- gulf.moneroocean.stream
- hellominer.com
- herominers.com
- hk-aipg.miningocean.org
- hk-dynex.miningocean.org
- hk-neurai.miningocean.org
- hk-qrl.miningocean.org
- hk-upx.miningocean.org
- hk-zephyr.miningocean.org
- hns.f2pool.com
- huadong1-aeon.ppxxmr.com
- imap.fastpool.xyz
- iwanttoearn.money
- joulecoin.org
- jp.moneroocean.stream
- jw-js1.ppxxmr.com
- koto-pool.work
- kronecoin.org
- kryptex.network
- kubo.ultra-pool.com
- lhr.nbminer.com
- lhr3.nbminer.com
- linux.monerpool.org
- litecoinpool.org
- lokiturtle.herominers.com
- luckpool.net
- luckypool.io
- mail.fastpool.xyz
- masari.miner.rocks
- mine.aeon-pool.com
- mine.bmpool.org
- mine.c3pool.com
- mine.fastpool.xyz
- mine.lesliejust.is
- mine.moneropool.com
- mine.ppxxmr.com
- mine.zpool.ca
- mine1.ppxxmr.com
- minemonero.gq
- miner.ppxxmr.com
- miner.rocks
- minercircle.com
- minergate.com
- minerpool.pw
- minerrocks.com
- miners.pro
- minerxmr.ru
- minexmr.cn
- minexmr.com
- mining-help.ru
- mining.bittubeapp.com
- miningocean.org
- miningpoolhub.com
- miningrigrentals.com
- mixpools.org
- moner.monerpool.org
- moner1min.monerpool.org
- monero-master.crypto-pool.fr
- monero.crypto-pool.fr
- monero.hashvault.pro
- monero.herominers.com
- monero.lindon-pool.win
- monero.miners.pro
- monero.riefly.id
- monero.us.to
- monerocean.stream
- monerogb.com
- monerohash.com
- moneroocean.stream
- monerooceans.stream
- moneropool.com
- moneropool.nl
- monerorx.com
- monerpool.org
- moriaxmr.com
- mro.pool.minergate.com
- multipool.us
- myxmr.pw
- na.luckpool.net
- nanopool.org
- nbminer.com
- node.btx.tools
- node3.luckpool.net
- noobxmr.com
- p06.2miners.com
- pangolinminer.com
- pool-de.supportxmr.com
- pool-fr.supportxmr.com
- pool-nyc.supportxmr.com
- pool-phx.supportxmr.com
- pool.4i7i.com
- pool.armornetwork.org
- pool.awgoaigartnj-xmr.com
- pool.cortins.tk
- pool.gntl.co.uk
- pool.hashvault.pro
- pool.minergate.com
- pool.minexmr.com
- pool.minexmr.uk
- pool.monero.hashvault.pro
- pool.ppxxmr.com
- pool.somec.cc
- pool.support
- pool.supportxmr.com
- pool.usa-138.com
- pool.xmr.pt
- pool.xmrfast.com
- pool2.armornetwork.org
- poolchange.ppxxmr.com
- pooldd.com
- poolmining.org
- poolto.be
- pop.fastpool.xyz
- ppxvip1.ppxxmr.com
- ppxxmr.com
- prohash.net
- r.twotouchauthentication.online
- randomx.xmrig.com
- ratchetmining.com
- rx.unmineable.com
- salvium.herominers.com
- seed.emercoin.com
- seed.emercoin.net
- seed.emergate.net
- seed.kronecoin.org
- seed.titcoinpool.com
- seed.titcoins.info
- seed1.joulecoin.org
- seed2.joulecoin.org
- seed3.joulecoin.org
- seed4.joulecoin.org
- seed5.joulecoin.org
- seed6.joulecoin.org
- seed7.joulecoin.org
- seed8.joulecoin.org
- sg-aipg.miningocean.org
- sg-dynex.miningocean.org
- sg-neurai.miningocean.org
- sg-qrl.miningocean.org
- sg-upx.miningocean.org
- sg-zephyr.miningocean.org
- sg.minexmr.com
- sheepman.mine.bz
- siamining.com
- smtp.fastpool.xyz
- solarray.club
- solo-grin.2miners.com
- solo-grin.2miners.ru
- solo-xmr.2miners.com
- solo-xmr.2miners.ru
- soloxmr2min.dyndns.org
- sparechange.io
- ssl.fastpool.xyz
- sumokoin.minerrocks.com
- supportxmr.com
- suprnova.cc
- system-check.services
- system-update.info
- teracycle.net
- titcoinpool.com
- titcoins.info
- tpool.yiluzhuanqian.com
- trtl.cnpool.cc
- trtl.pool.mine2gether.com
- turtle.miner.rocks
- ultra-pool.com
- unmineable.com
- us-aipg.miningocean.org
- us-dynex.miningocean.org
- us-grin.2miners.com
- us-neurai.miningocean.org
- us-west.minexmr.com
- us-zephyr.miningocean.org
- usxmrpool.com
- viaxmr.com
- web.xmrpool.eu
- webservicepag.webhop.net
- winxmr.club
- x109.node.btx.tools
- xcn1.yiluzhuanqian.com
- xiazai.monerpool.org
- xiazai1.monerpool.org
- xmc.pool.minergate.com
- xmo.pool.minergate.com
- xmr-asia1.nanopool.org
- xmr-au1.nanopool.org
- xmr-eu1.nanopool.org
- xmr-eu2.nanopool.org
- xmr-jp1.nanopool.org
- xmr-us-east1.nanopool.org
- xmr-us-west1.nanopool.org
- xmr-us.suprnova.cc
- xmr-usa.dwarfpool.com
- xmr.2miners.com
- xmr.5b6b7b.ru
- xmr.748pz.net
- xmr.alimabi.cn
- xmr.bepooh.com
- xmr.bohemianpool.com
- xmr.crypto-pool.fr
- xmr.crypto-pool.info
- xmr.f2pool.com
- xmr.hashcity.org
- xmr.hex7e4.ru
- xmr.ip28.net
- xmr.kryptex.network
- xmr.monerpool.org
- xmr.mypool.online
- xmr.nanopool.org
- xmr.pool.gntl.co.uk
- xmr.pool.minergate.com
- xmr.poolto.be
- xmr.ppxxmr.com
- xmr.prohash.net
- xmr.simka.pw
- xmr.somec.cc
- xmr.suprnova.cc
- xmr.usa-138.com
- xmr.vip.pool.minergate.com
- xmr.yiluzhuanqian.com
- xmr1min.monerpool.org
- xmrf.520fjh.org
- xmrf.fjhan.club
- xmrfast.com
- xmrigcc.graef.in
- xmrminer.cc
- xmrpool.de
- xmrpool.eu
- xmrpool.me
- xmrpool.net
- xmrpool.xyz
- xx11m.monerpool.org
- xx11mv2.monerpool.org
- xxx.hex7e4.ru
- yes.fastpool.xyz
- zarabotaibitok.ru
- zeph-eu2.nanopool.org
- zeph.2miners.com
- zephyr.herominers.com
- zer0day.ru
condition: selection
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: fa5b1358-b040-4403-9868-15f7d9ab6329
type: derived
What it detects
This rule identifies Windows systems initiating network connections to a hardcoded set of crypto mining pool hostnames. Such connections are commonly associated with cryptocurrency mining activity and can indicate miner malware or unauthorized use of the host for mining. The detection relies on network_connection telemetry that records the destination hostname of outbound sessions.
Known false positives
- Unlikely
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.