Query: detection rule: Detects initiated network connections to crypto mining pools. It indicates that the system is likely infected with a cry
Matching passage: Sigma rule: Detects initiated network connections to crypto mining pools. It indicates that the system is likely infected with a cry. Logsource: windows / network_connection. Rule: title: Network Communication With Crypto Mining Pool id: fa5b1358-b040-4403-9868-15f7d9ab6329 status: stable description: 'Detects initiated network connections to crypto mining pools. It indicates that the system is likely infected with a crypto miner malware or is being used for crypto mining. ' references: - https://www.poolwatch.io/coin/monero - https://github.com/stamparm/maltrail/blob/da082537e0f37b9dece3a6998583e43bb5709c4e/trails/static/suspicious/crypto_mining.txt - https://www.virustotal.com/gui/search/behaviour_network%253A*.miningocean.org/files author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2021-10-26 modified: 2026-07-24 tags: - attack.impact - attack.t1496 logsource: category: network_connection product: windows detection: selection: DestinationHostname: - aeon-pool.com - alimabi.cn - ap.luckpool.net - api.fastpool.xyz - auto.c3pool.org - awgoaigartnj-xmr.com - backup.fastpool.xyz - bcn.pool.minergate.com - bcn.vip.pool.minergate.com - bizxmr.cc - bmpool.org - bohemianpool.com - byw.dscloud.me - c3.wptask.cyou - c3pool.org - ca-aipg.miningocean.org - ca-dynex.miningocean.org - ca-neurai.miningocean.org - ca-qrl.miningocean.org - ca-upx.miningocean.org - ca-zephyr.miningocean.org - ca.minexmr.com - ca.monero.herominers.com - cbd.monerpool.org - cbdv2.monerpool.org - community-pools.mysrv.cloud - covid19crypto.com - cryptmonero.com - crypto-pool.fr - crypto-pool.info - cryptominded.com - cryptonight-hub.miningpoolhub.com - d1pool.ddns.net - d5pool.us - daili01.monerpool.org - de-aipg.miningocean.org - de-dynex.miningocean.org - de-zephyr.miningocean.org - de.minexmr.com - de.moneroocean.stream - de.salvium.herominers.com - de.zephyr.herominers.com - dl.nbminer.com - donate.graef.in - donate.ssl.xmrig.com - donate.v2.xmrig.com - donate.xmrig.com - donate2.graef.in - drill.moneroworld.com - dwarfpool.com - emercoin.com - emercoin.net - emergate.net - ethereumpool.co - eu.luckpool.net - eu.minerpool.pw - f2pool.com - fastpool.xyz - fcn-xmr.pool.minergate.com - fee.xmrig.com - fi.moneroocean.stream - fr-aipg.miningocean.org - fr-dynex.miningocean.org - fr-neurai.miningocean.org - fr-qrl.miningocean.org - fr-tarirx.luckypool.io - fr-upx.miningocean.org - fr-zephyr.miningocean.org - fr.minexmr.com - fr.moneroocean.stream - friendspool.club - ftp.fastpool.xyz - gandalph3000.com - googleminer.com - grin.2miners.com - gulf.moneroocean.stream - hellominer.com - herominers.com - hk-aipg.miningocean.org - hk-dynex.
Near-miss passage: Sigma rule: Detects a flashplayer update from an unofficial location. Logsource: proxy. Rule: title: Flash Player Update from Suspicious Location id: 4922a5dd-6743-4fc2-8e81-144374280997 status: test description: Detects a flashplayer update from an unofficial location references: - https://gist.github.com/roycewilliams/a723aaf8a6ac3ba4f817847610935cfb author: Florian Roth (Nextron Systems) date: 2017-10-25 modified: 2022-08-08 tags: - attack.initial-access - attack.stealth - attack.t1189 - attack.execution - attack.t1204.002 - attack.t1036.005 logsource: category: proxy detection: selection: - c-uri|contains: /flash_install.php - c-uri|endswith: /install_flash_player.exe filter: cs-host|endswith: .adobe.com condition: selection and not filter falsepositives: - Unknown flash download locations level: high