Connection to cryptomining pool

Classification:

attack

Tactic:

TA0040-impact

Technique:

T1496-resource-hijacking

このページは日本語には対応しておりません。随時翻訳に取り組んでいます。
翻訳に関してご質問やご意見ございましたら、お気軽にご連絡ください。

WARNING: This rule will be deprecated on 20 October 2025.

See the announcement for more information.

Goal

Detect when a resource connects to a known cryptocurrency mining pool.

Strategy

This detection enriches network flow data with threat intelligence and alerts when a destination domain is categorized as a mining pool.

Triage and response

  1. Use host metrics to verify if a spike in CPU usage occurred. If it did, determine the responsible process.
  2. Isolate the workload, preserving it for analysis.
  3. Determine the initial entry point using related signals and relevant logs.
  4. Find and repair the root cause of the incident.

This detection is based on data from Cloud Network Monitoring.