Query: detection rule: Identifies clients that may be performing DNS lookups associated with common currency mining pools.
Matching passage: Sigma rule: Identifies clients that may be performing DNS lookups associated with common currency mining pools.. Logsource: zeek / dns. Rule: title: DNS Events Related To Mining Pools id: bf74135c-18e8-4a72-a926-0e4f47888c19 status: test description: Identifies clients that may be performing DNS lookups associated with common currency mining pools. references: - https://github.com/Azure/Azure-Sentinel/blob/fa0411f9424b6c47b4d5a20165e4f1b168c1f103/Detections/ASimDNS/imDNS_Miners.yaml author: Saw Winn Naung, Azure-Sentinel, @neu5ron date: 2021-08-19 modified: 2022-07-07 tags: - attack.execution - attack.t1569.002 - attack.impact - attack.t1496 logsource: service: dns product: zeek detection: selection: query|endswith: - monerohash.com - do-dear.com - xmrminerpro.com - secumine.net - xmrpool.com - minexmr.org - hashanywhere.com - xmrget.com - mininglottery.eu - minergate.com - moriaxmr.com - multipooler.com - moneropools.com - xmrpool.eu - coolmining.club - supportxmr.com - minexmr.com - hashvault.pro - xmrpool.net - crypto-pool.fr - xmr.pt - miner.rocks - walpool.com - herominers.com - gntl.co.uk - semipool.com - coinfoundry.org - cryptoknight.cc - fairhash.org - baikalmine.com - tubepool.xyz - fairpool.xyz - asiapool.io - coinpoolit.webhop.me - nanopool.org - moneropool.com - miner.center - prohash.net - poolto.be - cryptoescrow.eu - monerominers.net - cryptonotepool.org - extrmepool.org - webcoin.me - kippo.eu - hashinvest.ws - monero.farm - linux-repository-updates.com - 1gh.com - dwarfpool.com - hash-to-coins.com - pool-proxy.com - hashfor.cash - fairpool.cloud - litecoinpool.org - mineshaft.ml - abcxyz.stream - moneropool.ru - cryptonotepool.org.uk - extremepool.org - extremehash.com - hashinvest.net - unipool.pro - crypto-pools.org - monero.net - backup-pool.com - mooo.com - freeyy.me - cryptonight.net - shscrypto.net exclude_answers: answers: - 127.0.0.1 - 0.0.0.0 exclude_rejected: rejected: 'true' condition: selection and not 1 of exclude_* falsepositives: - A DNS lookup does not necessarily mean a successful attempt, verify a) if there was a response using the zeek answers field, if there was then verify the connections (conn.log) to those IPs. b) verify if HTTP, SSL, or TLS activity to the domain that was queried. http.log field is 'host' and ssl/tls is 'server_name'. level: low
Near-miss passage: Sigma rule: Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the c. Logsource: windows / security. Rule: title: Invoke-Obfuscation Obfuscated IEX Invocation - Security id: fd0f5778-d3cb-4c9a-9695-66759d04702a related: - id: 51aa9387-1c53-4153-91cc-d73c59ae1ca9 type: derived status: test description: Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the code block linked in the references references: - https://github.com/danielbohannon/Invoke-Obfuscation/blob/f20e7f843edd0a3a7716736e9eddfa423395dd26/Out-ObfuscatedStringCommand.ps1#L873-L888 author: Daniel Bohannon (@Mandiant/@FireEye), oscd.community date: 2019-11-08 modified: 2022-11-27 tags: - attack.stealth - attack.t1027 logsource: product: windows service: security definition: The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697 detection: selection_eid: EventID: 4697 selection_servicefilename: - ServiceFileName|re: \$PSHome\[\s*\d{1,3}\s*\]\s*\+\s*\$PSHome\[ - ServiceFileName|re: \$ShellId\[\s*\d{1,3}\s*\]\s*\+\s*\$ShellId\[ - ServiceFileName|re: \$env:Public\[\s*\d{1,3}\s*\]\s*\+\s*\$env:Public\[ - ServiceFileName|re: \$env:ComSpec\[(\s*\d{1,3}\s*,){2} - ServiceFileName|re: \\*mdr\*\W\s*\)\.Name - ServiceFileName|re: \$VerbosePreference\.ToString\( - ServiceFileName|re: \String\]\s*\$VerbosePreference condition: all of selection_* falsepositives: - Unknown level: high