Estul Lachin

All rules

Cryptocurrency Miner Indicators

high Single event T1496 Impact

Miner binaries (xmrig, minerd, cpuminer), mining pool protocols (stratum+tcp, stratum+ssl) or pool names in a command. Resource hijacking is the most common goal of attacks on weak SSH passwords.

Tested

Matches all 3 attack events in match.jsonl and none of the 3 look-alike events in nomatch.jsonl. See the test events.

False positives

Sigma

title: Cryptocurrency Miner Indicators
id: 8dd7290a-644a-4db3-8cff-0096442c04de
status: experimental
description: |
  Miner binaries (xmrig, minerd, cpuminer), mining pool protocols (stratum+tcp, stratum+ssl) or pool
  names in a command. Resource hijacking is the most common goal of attacks on weak SSH passwords.
references:
  - https://attack.mitre.org/techniques/T1496/
author: Estul Lachin
date: 2026-11-08
tags:
  - attack.impact
  - attack.t1496
logsource:
  product: cowrie
detection:
  selection:
    eventid: cowrie.command.input
    input|re: '(?i)\b(xmrig|minerd|cpuminer|cryptonight)\b|stratum\+(tcp|ssl)://|c3pool|nicehash|supportxmr'
  condition: selection
falsepositives:
  - Hosts that are meant to mine (not expected on servers)
level: high

rules/crypto_miner.yml

Splunk SPL

``` Cryptocurrency Miner Indicators. Generated from rules/crypto_miner.yml by tools/build.py; do not edit. ```
index=honeypot sourcetype=cowrie:json eventid="cowrie.command.input"
| regex input="(?i)\\b(xmrig|minerd|cpuminer|cryptonight)\\b|stratum\\+(tcp|ssl)://|c3pool|nicehash|supportxmr"

Verified in Splunk against the test events. dist/spl/crypto_miner.spl

Microsoft Sentinel KQL

// Cryptocurrency Miner Indicators. Generated from rules/crypto_miner.yml by tools/build.py; do not edit.
Cowrie_CL
| where eventid =~ "cowrie.command.input" and input matches regex "(?i)\\b(xmrig|minerd|cpuminer|cryptonight)\\b|stratum\\+(tcp|ssl)://|c3pool|nicehash|supportxmr"

For a custom table Cowrie_CL with Cowrie's field names. Converted, not yet run in Sentinel. dist/kql/crypto_miner.kql