
title: Windows Crypto Mining Pool Connections
author: Florian Roth
date: 2021/10/26
description: Detects process connections to a Monero crypto mining pool
detection:
  SELECTION_1:
    EventID: 3
  SELECTION_2:
    DestinationHostname:
    - pool.minexmr.com
    - fr.minexmr.com
    - de.minexmr.com
    - sg.minexmr.com
    - ca.minexmr.com
    - us-west.minexmr.com
    - pool.supportxmr.com
    - mine.c3pool.com
    - xmr-eu1.nanopool.org
    - xmr-eu2.nanopool.org
    - xmr-us-east1.nanopool.org
    - xmr-us-west1.nanopool.org
    - xmr-asia1.nanopool.org
    - xmr-jp1.nanopool.org
    - xmr-au1.nanopool.org
    - xmr.2miners.com
    - xmr.hashcity.org
    - xmr.f2pool.com
    - xmrpool.eu
    - pool.hashvault.pro
    - moneroocean.stream
    - monerocean.stream
  condition: (SELECTION_1 and SELECTION_2)
falsepositives:
- Legitimate use of crypto miners
id: fa5b1358-b040-4403-9868-15f7d9ab6329
level: high
logsource:
  category: network_connection
  product: windows
references:
- https://www.poolwatch.io/coin/monero
status: stable
tags:
- attack.impact
- attack.t1496
ruletype: SIGMA
