Windows Network Connections to Known Crypto Mining Pools

ATT&CK techniques

Impact

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
- T1496Resource Hijacking

What it detects

This rule flags outbound network connections where the destination hostname matches a hardcoded set of crypto mining pool domains. Such traffic is a strong indicator that a system may be running mining software or participating in pooled cryptocurrency mining. It relies on Windows network connection telemetry containing destination hostnames, with matching performed against the listed pool hostnames.

Reporting behind it

Related detections9 linkedT1496 — drag to rearrange

Malicious Hadooken Cryptominer Execution via Masqueraded Binaries (via process_creation)

Suspicious Lucifer Botnet Mining Pool Domain Resolution (via dns_query)

Suspicious Proxyjacking Service Resolution Observed in perfctl Campaign (via dns_query)

Malicious PureMiner Persistence Executable in AppData HResult Folder

Suspicious T-Rex CoinMiner Binaries in Windows NT Program Files Folder (via file_event)

Malicious Cryptocurrency Miner Execution (via process_creation)

Possible Cryptomining Beacon to c3pool Mining Domain

Malicious XMRig Cryptominer Execution with NiceHash Pool Arguments

Suspicious Payload Execution From systemd-private Temporary Directory on Linux

Windows Network Connections to Known Crypto Mining Pools

Pivot detection · T1496 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-network-connections-to-known-crypto-mining-pool-hostnames-fa5b1358

title: Windows Network Connections to Known Crypto Mining Pools
id: 1c9006f3-4c48-41da-9e01-cda1ba4f6011
status: stable
description: This rule flags outbound network connections where the destination hostname matches a hardcoded set of crypto mining pool domains. Such traffic is a strong indicator that a system may be running mining software or participating in pooled cryptocurrency mining. It relies on Windows network connection telemetry containing destination hostnames, with matching performed against the listed pool hostnames.
references:
  - https://www.poolwatch.io/coin/monero
  - https://github.com/stamparm/maltrail/blob/da082537e0f37b9dece3a6998583e43bb5709c4e/trails/static/suspicious/crypto_mining.txt
  - https://www.virustotal.com/gui/search/behaviour_network%253A*.miningocean.org/files
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_domain_crypto_mining_pools.yml
author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2021-10-26
modified: 2026-07-24
tags:
  - attack.impact
  - attack.t1496
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationHostname:
      - aeon-pool.com
      - alimabi.cn
      - ap.luckpool.net
      - api.fastpool.xyz
      - auto.c3pool.org
      - awgoaigartnj-xmr.com
      - backup.fastpool.xyz
      - bcn.pool.minergate.com
      - bcn.vip.pool.minergate.com
      - bizxmr.cc
      - bmpool.org
      - bohemianpool.com
      - byw.dscloud.me
      - c3.wptask.cyou
      - c3pool.org
      - ca-aipg.miningocean.org
      - ca-dynex.miningocean.org
      - ca-neurai.miningocean.org
      - ca-qrl.miningocean.org
      - ca-upx.miningocean.org
      - ca-zephyr.miningocean.org
      - ca.minexmr.com
      - ca.monero.herominers.com
      - cbd.monerpool.org
      - cbdv2.monerpool.org
      - community-pools.mysrv.cloud
      - covid19crypto.com
      - cryptmonero.com
      - crypto-pool.fr
      - crypto-pool.info
      - cryptominded.com
      - cryptonight-hub.miningpoolhub.com
      - d1pool.ddns.net
      - d5pool.us
      - daili01.monerpool.org
      - de-aipg.miningocean.org
      - de-dynex.miningocean.org
      - de-zephyr.miningocean.org
      - de.minexmr.com
      - de.moneroocean.stream
      - de.salvium.herominers.com
      - de.zephyr.herominers.com
      - dl.nbminer.com
      - donate.graef.in
      - donate.ssl.xmrig.com
      - donate.v2.xmrig.com
      - donate.xmrig.com
      - donate2.graef.in
      - drill.moneroworld.com
      - dwarfpool.com
      - emercoin.com
      - emercoin.net
      - emergate.net
      - ethereumpool.co
      - eu.luckpool.net
      - eu.minerpool.pw
      - f2pool.com
      - fastpool.xyz
      - fcn-xmr.pool.minergate.com
      - fee.xmrig.com
      - fi.moneroocean.stream
      - fr-aipg.miningocean.org
      - fr-dynex.miningocean.org
      - fr-neurai.miningocean.org
      - fr-qrl.miningocean.org
      - fr-tarirx.luckypool.io
      - fr-upx.miningocean.org
      - fr-zephyr.miningocean.org
      - fr.minexmr.com
      - fr.moneroocean.stream
      - friendspool.club
      - ftp.fastpool.xyz
      - gandalph3000.com
      - googleminer.com
      - grin.2miners.com
      - gulf.moneroocean.stream
      - hellominer.com
      - herominers.com
      - hk-aipg.miningocean.org
      - hk-dynex.miningocean.org
      - hk-neurai.miningocean.org
      - hk-qrl.miningocean.org
      - hk-upx.miningocean.org
      - hk-zephyr.miningocean.org
      - hns.f2pool.com
      - huadong1-aeon.ppxxmr.com
      - imap.fastpool.xyz
      - iwanttoearn.money
      - joulecoin.org
      - jp.moneroocean.stream
      - jw-js1.ppxxmr.com
      - koto-pool.work
      - kronecoin.org
      - kryptex.network
      - kubo.ultra-pool.com
      - lhr.nbminer.com
      - lhr3.nbminer.com
      - linux.monerpool.org
      - litecoinpool.org
      - lokiturtle.herominers.com
      - luckpool.net
      - luckypool.io
      - mail.fastpool.xyz
      - masari.miner.rocks
      - mine.aeon-pool.com
      - mine.bmpool.org
      - mine.c3pool.com
      - mine.fastpool.xyz
      - mine.lesliejust.is
      - mine.moneropool.com
      - mine.ppxxmr.com
      - mine.zpool.ca
      - mine1.ppxxmr.com
      - minemonero.gq
      - miner.ppxxmr.com
      - miner.rocks
      - minercircle.com
      - minergate.com
      - minerpool.pw
      - minerrocks.com
      - miners.pro
      - minerxmr.ru
      - minexmr.cn
      - minexmr.com
      - mining-help.ru
      - mining.bittubeapp.com
      - miningocean.org
      - miningpoolhub.com
      - miningrigrentals.com
      - mixpools.org
      - moner.monerpool.org
      - moner1min.monerpool.org
      - monero-master.crypto-pool.fr
      - monero.crypto-pool.fr
      - monero.hashvault.pro
      - monero.herominers.com
      - monero.lindon-pool.win
      - monero.miners.pro
      - monero.riefly.id
      - monero.us.to
      - monerocean.stream
      - monerogb.com
      - monerohash.com
      - moneroocean.stream
      - monerooceans.stream
      - moneropool.com
      - moneropool.nl
      - monerorx.com
      - monerpool.org
      - moriaxmr.com
      - mro.pool.minergate.com
      - multipool.us
      - myxmr.pw
      - na.luckpool.net
      - nanopool.org
      - nbminer.com
      - node.btx.tools
      - node3.luckpool.net
      - noobxmr.com
      - p06.2miners.com
      - pangolinminer.com
      - pool-de.supportxmr.com
      - pool-fr.supportxmr.com
      - pool-nyc.supportxmr.com
      - pool-phx.supportxmr.com
      - pool.4i7i.com
      - pool.armornetwork.org
      - pool.awgoaigartnj-xmr.com
      - pool.cortins.tk
      - pool.gntl.co.uk
      - pool.hashvault.pro
      - pool.minergate.com
      - pool.minexmr.com
      - pool.minexmr.uk
      - pool.monero.hashvault.pro
      - pool.ppxxmr.com
      - pool.somec.cc
      - pool.support
      - pool.supportxmr.com
      - pool.usa-138.com
      - pool.xmr.pt
      - pool.xmrfast.com
      - pool2.armornetwork.org
      - poolchange.ppxxmr.com
      - pooldd.com
      - poolmining.org
      - poolto.be
      - pop.fastpool.xyz
      - ppxvip1.ppxxmr.com
      - ppxxmr.com
      - prohash.net
      - r.twotouchauthentication.online
      - randomx.xmrig.com
      - ratchetmining.com
      - rx.unmineable.com
      - salvium.herominers.com
      - seed.emercoin.com
      - seed.emercoin.net
      - seed.emergate.net
      - seed.kronecoin.org
      - seed.titcoinpool.com
      - seed.titcoins.info
      - seed1.joulecoin.org
      - seed2.joulecoin.org
      - seed3.joulecoin.org
      - seed4.joulecoin.org
      - seed5.joulecoin.org
      - seed6.joulecoin.org
      - seed7.joulecoin.org
      - seed8.joulecoin.org
      - sg-aipg.miningocean.org
      - sg-dynex.miningocean.org
      - sg-neurai.miningocean.org
      - sg-qrl.miningocean.org
      - sg-upx.miningocean.org
      - sg-zephyr.miningocean.org
      - sg.minexmr.com
      - sheepman.mine.bz
      - siamining.com
      - smtp.fastpool.xyz
      - solarray.club
      - solo-grin.2miners.com
      - solo-grin.2miners.ru
      - solo-xmr.2miners.com
      - solo-xmr.2miners.ru
      - soloxmr2min.dyndns.org
      - sparechange.io
      - ssl.fastpool.xyz
      - sumokoin.minerrocks.com
      - supportxmr.com
      - suprnova.cc
      - system-check.services
      - system-update.info
      - teracycle.net
      - titcoinpool.com
      - titcoins.info
      - tpool.yiluzhuanqian.com
      - trtl.cnpool.cc
      - trtl.pool.mine2gether.com
      - turtle.miner.rocks
      - ultra-pool.com
      - unmineable.com
      - us-aipg.miningocean.org
      - us-dynex.miningocean.org
      - us-grin.2miners.com
      - us-neurai.miningocean.org
      - us-west.minexmr.com
      - us-zephyr.miningocean.org
      - usxmrpool.com
      - viaxmr.com
      - web.xmrpool.eu
      - webservicepag.webhop.net
      - winxmr.club
      - x109.node.btx.tools
      - xcn1.yiluzhuanqian.com
      - xiazai.monerpool.org
      - xiazai1.monerpool.org
      - xmc.pool.minergate.com
      - xmo.pool.minergate.com
      - xmr-asia1.nanopool.org
      - xmr-au1.nanopool.org
      - xmr-eu1.nanopool.org
      - xmr-eu2.nanopool.org
      - xmr-jp1.nanopool.org
      - xmr-us-east1.nanopool.org
      - xmr-us-west1.nanopool.org
      - xmr-us.suprnova.cc
      - xmr-usa.dwarfpool.com
      - xmr.2miners.com
      - xmr.5b6b7b.ru
      - xmr.748pz.net
      - xmr.alimabi.cn
      - xmr.bepooh.com
      - xmr.bohemianpool.com
      - xmr.crypto-pool.fr
      - xmr.crypto-pool.info
      - xmr.f2pool.com
      - xmr.hashcity.org
      - xmr.hex7e4.ru
      - xmr.ip28.net
      - xmr.kryptex.network
      - xmr.monerpool.org
      - xmr.mypool.online
      - xmr.nanopool.org
      - xmr.pool.gntl.co.uk
      - xmr.pool.minergate.com
      - xmr.poolto.be
      - xmr.ppxxmr.com
      - xmr.prohash.net
      - xmr.simka.pw
      - xmr.somec.cc
      - xmr.suprnova.cc
      - xmr.usa-138.com
      - xmr.vip.pool.minergate.com
      - xmr.yiluzhuanqian.com
      - xmr1min.monerpool.org
      - xmrf.520fjh.org
      - xmrf.fjhan.club
      - xmrfast.com
      - xmrigcc.graef.in
      - xmrminer.cc
      - xmrpool.de
      - xmrpool.eu
      - xmrpool.me
      - xmrpool.net
      - xmrpool.xyz
      - xx11m.monerpool.org
      - xx11mv2.monerpool.org
      - xxx.hex7e4.ru
      - yes.fastpool.xyz
      - zarabotaibitok.ru
      - zeph-eu2.nanopool.org
      - zeph.2miners.com
      - zephyr.herominers.com
      - zer0day.ru
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: fa5b1358-b040-4403-9868-15f7d9ab6329
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL