Zeek DNS Queries Ending in Known Crypto Mining Pool Domains

ATT&CK techniques

Execution → Impact

Recon
Resource Dev
Initial Access
Execution
- T1569.002Service Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
- T1496Resource Hijacking

What it detects

This rule flags Zeek DNS events where the queried domain ends with a set of commonly used mining pool domains. Attackers may use these lookups to reach pool/proxy infrastructure for cryptocurrency mining, making DNS request patterns a useful early indicator. It relies on Zeek DNS query telemetry (query name) and uses Zeek DNS answer and rejection context to reduce noise from local/invalid responses.

Reporting behind it

Related detections9 linkedT1496 — drag to rearrange

Malicious Hadooken Cryptominer Execution via Masqueraded Binaries (via process_creation)

Suspicious Lucifer Botnet Mining Pool Domain Resolution (via dns_query)

Suspicious Proxyjacking Service Resolution Observed in perfctl Campaign (via dns_query)

Malicious PureMiner Persistence Executable in AppData HResult Folder

Suspicious T-Rex CoinMiner Binaries in Windows NT Program Files Folder (via file_event)

PsExec Remote Service Execution on Target Host (via process_creation)

Malicious Cryptocurrency Miner Execution (via process_creation)

Renamed Procdump Tool Used for Dumping LSASS Process (via process_creation)

Possible Cryptomining Beacon to c3pool Mining Domain

Zeek DNS Queries Ending in Known Crypto Mining Pool Domains

Pivot detection · T1496 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

zeek-dns-lookups-for-known-cryptocurrency-mining-pool-domains-bf74135c

title: Zeek DNS Queries Ending in Known Crypto Mining Pool Domains
id: 5151c346-7996-4707-8297-c2b4018b2bd0
status: test
description: This rule flags Zeek DNS events where the queried domain ends with a set of commonly used mining pool domains. Attackers may use these lookups to reach pool/proxy infrastructure for cryptocurrency mining, making DNS request patterns a useful early indicator. It relies on Zeek DNS query telemetry (query name) and uses Zeek DNS answer and rejection context to reduce noise from local/invalid responses.
references:
  - https://github.com/Azure/Azure-Sentinel/blob/fa0411f9424b6c47b4d5a20165e4f1b168c1f103/Detections/ASimDNS/imDNS_Miners.yaml
  - https://github.com/SigmaHQ/sigma/blob/master/rules/network/zeek/zeek_dns_mining_pools.yml
author: Saw Winn Naung, Azure-Sentinel, @neu5ron, Huntrule Team
date: 2021-08-19
modified: 2022-07-07
tags:
  - attack.execution
  - attack.t1569.002
  - attack.impact
  - attack.t1496
logsource:
  service: dns
  product: zeek
detection:
  selection:
    query|endswith:
      - monerohash.com
      - do-dear.com
      - xmrminerpro.com
      - secumine.net
      - xmrpool.com
      - minexmr.org
      - hashanywhere.com
      - xmrget.com
      - mininglottery.eu
      - minergate.com
      - moriaxmr.com
      - multipooler.com
      - moneropools.com
      - xmrpool.eu
      - coolmining.club
      - supportxmr.com
      - minexmr.com
      - hashvault.pro
      - xmrpool.net
      - crypto-pool.fr
      - xmr.pt
      - miner.rocks
      - walpool.com
      - herominers.com
      - gntl.co.uk
      - semipool.com
      - coinfoundry.org
      - cryptoknight.cc
      - fairhash.org
      - baikalmine.com
      - tubepool.xyz
      - fairpool.xyz
      - asiapool.io
      - coinpoolit.webhop.me
      - nanopool.org
      - moneropool.com
      - miner.center
      - prohash.net
      - poolto.be
      - cryptoescrow.eu
      - monerominers.net
      - cryptonotepool.org
      - extrmepool.org
      - webcoin.me
      - kippo.eu
      - hashinvest.ws
      - monero.farm
      - linux-repository-updates.com
      - 1gh.com
      - dwarfpool.com
      - hash-to-coins.com
      - pool-proxy.com
      - hashfor.cash
      - fairpool.cloud
      - litecoinpool.org
      - mineshaft.ml
      - abcxyz.stream
      - moneropool.ru
      - cryptonotepool.org.uk
      - extremepool.org
      - extremehash.com
      - hashinvest.net
      - unipool.pro
      - crypto-pools.org
      - monero.net
      - backup-pool.com
      - mooo.com
      - freeyy.me
      - cryptonight.net
      - shscrypto.net
  exclude_answers:
    answers:
      - 127.0.0.1
      - 0.0.0.0
  exclude_rejected:
    rejected: "true"
  condition: selection and not 1 of exclude_*
falsepositives:
  - A DNS lookup does not necessarily  mean a successful attempt, verify a) if there was a response using the zeek answers field, if there was then verify the connections (conn.log) to those IPs. b) verify if HTTP, SSL, or TLS activity to the domain that was queried. http.log field is 'host' and ssl/tls is 'server_name'.
level: low
license: DRL-1.1
related:
  - id: bf74135c-18e8-4a72-a926-0e4f47888c19
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL