Query: write Sigma for Detects initiated network connections to crypto mining pools. It indicates that the system is likely infected with a cry
Matching passage: Sigma rule: Detects initiated network connections to crypto mining pools. It indicates that the system is likely infected with a cry. Logsource: windows / network_connection. Rule: title: Network Communication With Crypto Mining Pool id: fa5b1358-b040-4403-9868-15f7d9ab6329 status: stable description: 'Detects initiated network connections to crypto mining pools. It indicates that the system is likely infected with a crypto miner malware or is being used for crypto mining. ' references: - https://www.poolwatch.io/coin/monero - https://github.com/stamparm/maltrail/blob/da082537e0f37b9dece3a6998583e43bb5709c4e/trails/static/suspicious/crypto_mining.txt - https://www.virustotal.com/gui/search/behaviour_network%253A*.miningocean.org/files author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2021-10-26 modified: 2026-07-24 tags: - attack.impact - attack.t1496 logsource: category: network_connection product: windows detection: selection: DestinationHostname: - aeon-pool.com - alimabi.cn - ap.luckpool.net - api.fastpool.xyz - auto.c3pool.org - awgoaigartnj-xmr.com - backup.fastpool.xyz - bcn.pool.minergate.com - bcn.vip.pool.minergate.com - bizxmr.cc - bmpool.org - bohemianpool.com - byw.dscloud.me - c3.wptask.cyou - c3pool.org - ca-aipg.miningocean.org - ca-dynex.miningocean.org - ca-neurai.miningocean.org - ca-qrl.miningocean.org - ca-upx.miningocean.org - ca-zephyr.miningocean.org - ca.minexmr.com - ca.monero.herominers.com - cbd.monerpool.org - cbdv2.monerpool.org - community-pools.mysrv.cloud - covid19crypto.com - cryptmonero.com - crypto-pool.fr - crypto-pool.info - cryptominded.com - cryptonight-hub.miningpoolhub.com - d1pool.ddns.net - d5pool.us - daili01.monerpool.org - de-aipg.miningocean.org - de-dynex.miningocean.org - de-zephyr.miningocean.org - de.minexmr.com - de.moneroocean.stream - de.salvium.herominers.com - de.zephyr.herominers.com - dl.nbminer.com - donate.graef.in - donate.ssl.xmrig.com - donate.v2.xmrig.com - donate.xmrig.com - donate2.graef.in - drill.moneroworld.com - dwarfpool.com - emercoin.com - emercoin.net - emergate.net - ethereumpool.co - eu.luckpool.net - eu.minerpool.pw - f2pool.com - fastpool.xyz - fcn-xmr.pool.minergate.com - fee.xmrig.com - fi.moneroocean.stream - fr-aipg.miningocean.org - fr-dynex.miningocean.org - fr-neurai.miningocean.org - fr-qrl.miningocean.org - fr-tarirx.luckypool.io - fr-upx.miningocean.org - fr-zephyr.miningocean.org - fr.minexmr.com - fr.moneroocean.stream - friendspool.club - ftp.fastpool.xyz - gandalph3000.com - googleminer.com - grin.2miners.com - gulf.moneroocean.stream - hellominer.com - herominers.com - hk-aipg.miningocean.org - hk-dynex.
Near-miss passage: Sigma rule: Detects the command line executed when TeamViewer starts a session started by a remote host. Once a connection has been. Logsource: linux / process_creation. Rule: title: Remote Access Tool - Team Viewer Session Started On Linux Host id: 1f6b8cd4-3e60-47cc-b282-5aa1cbc9182d related: - id: ab70c354-d9ac-4e11-bbb6-ec8e3b153357 type: similar - id: f459ccb4-9805-41ea-b5b2-55e279e2424a type: similar status: test description: 'Detects the command line executed when TeamViewer starts a session started by a remote host. Once a connection has been started, an investigator can verify the connection details by viewing the "incoming_connections.txt" log file in the TeamViewer folder. ' references: - Internal Research author: Josh Nickels, Qi Nan date: 2024-03-11 tags: - attack.persistence - attack.initial-access - attack.t1133 logsource: category: process_creation product: linux detection: selection: ParentImage|endswith: /TeamViewer_Service Image|endswith: /TeamViewer_Desktop CommandLine|endswith: /TeamViewer_Desktop --IPCport 5939 --Module 1 condition: selection falsepositives: - Legitimate usage of TeamViewer level: low