Query: write Sigma for Detects command line parameters or strings often used by crypto miners
Matching passage: Sigma rule: Detects command line parameters or strings often used by crypto miners. Logsource: windows / process_creation. Rule: title: Potential Crypto Mining Activity id: 66c3b204-9f88-4d0a-a7f7-8a57d521ca55 status: stable description: Detects command line parameters or strings often used by crypto miners references: - https://www.poolwatch.io/coin/monero author: Florian Roth (Nextron Systems) date: 2021-10-26 modified: 2023-02-13 tags: - attack.impact - attack.t1496 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: - ' --cpu-priority=' - --donate-level=0 - ' -o pool.' - ' --nicehash' - ' --algo=rx/0 ' - stratum+tcp:// - stratum+udp:// - LS1kb25hdGUtbGV2ZWw9 - 0tZG9uYXRlLWxldmVsP - tLWRvbmF0ZS1sZXZlbD - c3RyYXR1bSt0Y3A6Ly - N0cmF0dW0rdGNwOi8v - zdHJhdHVtK3RjcDovL - c3RyYXR1bSt1ZHA6Ly - N0cmF0dW0rdWRwOi8v - zdHJhdHVtK3VkcDovL filter: CommandLine|contains: - ' pool.c ' - ' pool.o ' - gcc - condition: selection and not filter falsepositives: - Legitimate use of crypto miners - Some build frameworks level: high
Near-miss passage: Sigma rule: Detects loading of known vulnerable drivers via their hash.. Logsource: windows / driver_load. Rule: title: Vulnerable Driver Load id: 7aaaf4b8-e47c-4295-92ee-6ed40a6f60c8 status: test description: Detects loading of known vulnerable drivers via their hash. references: - https://loldrivers.io/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-18 modified: 2023-12-02 tags: - attack.persistence - attack.privilege-escalation - attack.t1543.003 - attack.t1068 logsource: product: windows category: driver_load detection: selection: Hashes|contains: - MD5=c996d7971c49252c582171d9380360f2 - MD5=da7e98b23b49b7293ee06713032c74f6 - MD5=9496585198d726000ea505abc39dbfe9 - MD5=649ff59b8e571c1fc6535b31662407aa - MD5=4429f85e2415742c7cf8c9f54905c4b9 - MD5=a610cd4c762b5af8575285dafb9baa8f - MD5=d5e76d125d624f8025d534f49e3c4162 - MD5=9c8fffef24fc480917236f9a20b80a47 - MD5=65b979bcab915c3922578fe77953d789 - MD5=598f8fb2317350e5f90b7bd16baf5738 - MD5=6691e873354f1914692df104718eebad - MD5=4814205270caa80d35569eee8081838e - MD5=7f9128654c3def08c28e0e13efff0fee - MD5=ce952204558ea66ec1a9632dcbdde8bd - MD5=0c0195c48b6b8582fa6f6373032118da - MD5=370a4ca29a7cf1d6bc0744afc12b236c - MD5=67e03f83c503c3f11843942df32efe5a - MD5=8a70921638ff82bb924456deadcd20e6 - MD5=8a212a246b3c41f3ddce5888aaaaacd6 - MD5=a346417e9ae2c17a8fbf73302eeb611d - MD5=d4f7c14e92b36c341c41ae93159407dd - MD5=748cf64b95ca83abc35762ad2c25458f - MD5=79ab228766c76cfdf42a64722821711e - MD5=ce67e51b8c0370d1bfe421b79fa8b656 - MD5=25190f667f31318dd9a2e36383d5709f - MD5=1f263a57c5ef46c8577744ecb32c9548 - MD5=c6cfa2d6e4c443e673c2c12417ea3001 - MD5=cceb3a7e3bd0203c807168b393a65a74 - MD5=56b54823a79a53747cbe11f8c4db7b1e - MD5=988dabdcf990b134b0ac1e00512c30c4 - MD5=09e77d71d626574e6142894caca6e6dd - MD5=c832a4313ff082258240b61b88efa025 - MD5=44499d3cab387aa78a4a6eca2ac181fb - MD5=6ff59faea912903af0ba8e80e58612bc - MD5=7461f0f9b931044a9d5f1d44eb4e8e09 - MD5=08bac71557df8a9b1381c8c165f64520 - MD5=fea9319d67177ed6f36438d2bd9392fb - MD5=6dd82d91f981893be57ff90101a7f7f1 - MD5=d4119a5cb07ce945c6549eae74e39731 - MD5=cf1113723e3c1c71af80d228f040c198 - MD5=0e625b7a7c3f75524e307b160f8db337 - MD5=6e1faeee0ebfcb384208772410fe1e86 - MD5=58a92520dda53166e322118ee0503364 - MD5=916ba55fc004b85939ee0cc86a5191c5 - MD5=f16b44cca74d3c3645e4c0a6bb5c0cb9 - MD5=db2fc89098ac722dabe3c37ed23de340 - MD5=6f5cf7feb9bb8108b68f169b8e625ffe - MD5=d2588631d8aae2a3e54410eaf54f0679 - MD5=72acbdd8fac58b71b301980eab3ebfc8 - MD5=9cc757a18b86408efc1ce3ed20cbcdac - MD5=230fd3749904ca045ea5ec0aa14006e9 - MD5=79329e2917623181888605bc5b302711 - MD5=3e4a