title: Windows Crypto Mining Indicators
author: Florian Roth
date: 2021/10/26
description: Detects command line parameters or strings often used by crypto miners
detection:
  SELECTION_1:
    EventID: 1
  SELECTION_2:
    CommandLine:
    - '* --cpu-priority=*'
    - '*--donate-level=0*'
    - '* -o pool.*'
    - '* --nicehash*'
    - '* --algo=rx/0 *'
    - '*stratum+tcp://*'
    - '*stratum+udp://*'
    - '*LS1kb25hdGUtbGV2ZWw9*'
    - '*0tZG9uYXRlLWxldmVsP*'
    - '*tLWRvbmF0ZS1sZXZlbD*'
    - '*c3RyYXR1bSt0Y3A6Ly*'
    - '*N0cmF0dW0rdGNwOi8v*'
    - '*zdHJhdHVtK3RjcDovL*'
    - '*c3RyYXR1bSt1ZHA6Ly*'
    - '*N0cmF0dW0rdWRwOi8v*'
    - '*zdHJhdHVtK3VkcDovL*'
  condition: (SELECTION_1 and SELECTION_2)
falsepositives:
- Legitimate use of crypto miners
id: 66c3b204-9f88-4d0a-a7f7-8a57d521ca55
level: high
logsource:
  category: process_creation
  product: windows
references:
- https://www.poolwatch.io/coin/monero
status: stable
tags:
- attack.impact
- attack.t1496
ruletype: SIGMA