Query: detect Detects initiated network connections to crypto mining pools. It indicates that the system is likely infected with a cry in logs
Matching passage: Sigma rule: Detects initiated network connections to crypto mining pools. It indicates that the system is likely infected with a cry. Logsource: windows / network_connection. Rule: title: Network Communication With Crypto Mining Pool id: fa5b1358-b040-4403-9868-15f7d9ab6329 status: stable description: 'Detects initiated network connections to crypto mining pools. It indicates that the system is likely infected with a crypto miner malware or is being used for crypto mining. ' references: - https://www.poolwatch.io/coin/monero - https://github.com/stamparm/maltrail/blob/da082537e0f37b9dece3a6998583e43bb5709c4e/trails/static/suspicious/crypto_mining.txt - https://www.virustotal.com/gui/search/behaviour_network%253A*.miningocean.org/files author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2021-10-26 modified: 2026-07-24 tags: - attack.impact - attack.t1496 logsource: category: network_connection product: windows detection: selection: DestinationHostname: - aeon-pool.com - alimabi.cn - ap.luckpool.net - api.fastpool.xyz - auto.c3pool.org - awgoaigartnj-xmr.com - backup.fastpool.xyz - bcn.pool.minergate.com - bcn.vip.pool.minergate.com - bizxmr.cc - bmpool.org - bohemianpool.com - byw.dscloud.me - c3.wptask.cyou - c3pool.org - ca-aipg.miningocean.org - ca-dynex.miningocean.org - ca-neurai.miningocean.org - ca-qrl.miningocean.org - ca-upx.miningocean.org - ca-zephyr.miningocean.org - ca.minexmr.com - ca.monero.herominers.com - cbd.monerpool.org - cbdv2.monerpool.org - community-pools.mysrv.cloud - covid19crypto.com - cryptmonero.com - crypto-pool.fr - crypto-pool.info - cryptominded.com - cryptonight-hub.miningpoolhub.com - d1pool.ddns.net - d5pool.us - daili01.monerpool.org - de-aipg.miningocean.org - de-dynex.miningocean.org - de-zephyr.miningocean.org - de.minexmr.com - de.moneroocean.stream - de.salvium.herominers.com - de.zephyr.herominers.com - dl.nbminer.com - donate.graef.in - donate.ssl.xmrig.com - donate.v2.xmrig.com - donate.xmrig.com - donate2.graef.in - drill.moneroworld.com - dwarfpool.com - emercoin.com - emercoin.net - emergate.net - ethereumpool.co - eu.luckpool.net - eu.minerpool.pw - f2pool.com - fastpool.xyz - fcn-xmr.pool.minergate.com - fee.xmrig.com - fi.moneroocean.stream - fr-aipg.miningocean.org - fr-dynex.miningocean.org - fr-neurai.miningocean.org - fr-qrl.miningocean.org - fr-tarirx.luckypool.io - fr-upx.miningocean.org - fr-zephyr.miningocean.org - fr.minexmr.com - fr.moneroocean.stream - friendspool.club - ftp.fastpool.xyz - gandalph3000.com - googleminer.com - grin.2miners.com - gulf.moneroocean.stream - hellominer.com - herominers.com - hk-aipg.miningocean.org - hk-dynex.
Near-miss passage: Sigma rule: This detection excludes known namped pipes accessible remotely and notify on newly observed ones, may help to detect lat. Logsource: windows / security. Rule: title: First Time Seen Remote Named Pipe id: 52d8b0c6-53d6-439a-9e41-52ad442ad9ad status: test description: This detection excludes known namped pipes accessible remotely and notify on newly observed ones, may help to detect lateral movement and remote exec using named pipes references: - https://twitter.com/menasec1/status/1104489274387451904 author: Samir Bousseaden date: 2019-04-03 modified: 2023-03-14 tags: - attack.lateral-movement - attack.t1021.002 logsource: product: windows service: security definition: The advanced audit policy setting "Object Access > Audit Detailed File Share" must be configured for Success/Failure detection: selection1: EventID: 5145 ShareName: \\\\\*\\IPC$ false_positives: RelativeTargetName: - atsvc - samr - lsarpc - lsass - winreg - netlogon - srvsvc - protected_storage - wkssvc - browser - netdfs - svcctl - spoolss - ntsvcs - LSM_API_service - HydraLsPipe - TermSrv_API_service - MsFteWds - sql\query - eventlog condition: selection1 and not false_positives falsepositives: - Update the excluded named pipe to filter out any newly observed legit named pipe level: high