Cloud provider activity observed from IP associated with cryptomining

This rule is part of a beta feature. To learn more, contact Support.

Classification:

threat-intel

Tactic:

TA0011-command-and-control

Technique:

T1071-application-layer-protocol

This page is not yet available in Spanish. We are working on its translation.
If you have any questions or feedback about our current translation project, feel free to reach out to us!

Goal

Detect when a host in AWS, GCP, or Azure is potentially infected with a cryptominer.

Strategy

This rule compares the @network.client.ip standard attribute to a curated threat intelligence list of known cryptomining IP addresses.

Triage and response

  1. Determine if the resource should be contacting a cryptomining associated IP address.
  2. If not, begin your company’s incident response process.