Connection to cryptomining pool

Classification:

attack

Tactic:

TA0040-impact

Technique:

T1496-resource-hijacking

이 페이지는 아직 한국어로 제공되지 않으며 번역 작업 중입니다. 번역에 관한 질문이나 의견이 있으시면 언제든지 저희에게 연락해 주십시오.

Goal

Detect when a resource connects to a known cryptocurrency mining pool.

Strategy

This detection enriches network flow data with threat intelligence and alerts when a destination domain is categorized as a mining pool.

Triage and response

  1. Use host metrics to verify if a spike in CPU usage occurred. If it did, determine the responsible process.
  2. Isolate the workload, preserving it for analysis.
  3. Determine the initial entry point using related signals and relevant logs.
  4. Find and repair the root cause of the incident.

This detection is based on data from Network Performance Monitoring.