---
title: DNS query to known Monero cryptomining pool domain
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > DNS query to known Monero cryptomining
  pool domain
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# DNS query to known Monero cryptomining pool domain
Classification:attackTactic:[TA0040-impact](https://attack.mitre.org/tactics/TA0040)Technique:[T1496-resource-hijacking](https://attack.mitre.org/techniques/T1496) 
## Goal{% #goal %}

Detects a DNS query to a domain operated by a known Monero cryptomining pool. This can indicate unauthorized cryptomining, including malware-driven cryptojacking or unsanctioned use of company infrastructure.

## Strategy{% #strategy %}

This rule monitors DNS queries where `@ocsf.query.hostname` matches a known Monero mining pool domain, including endpoints operated by `minexmr.com`, `supportxmr.com`, `c3pool.com`, `nanopool.org`, `2miners.com`, `hashcity.org`, `f2pool.com`, `xmrpool.eu`, and `hashvault.pro`.

Mining software connects to these pools to receive mining work and submit computed hashes. DNS queries to pool domains can therefore indicate cryptomining activity, including malware-driven cryptojacking or unauthorized mining.

A single matching query triggers the rule, but does not confirm that mining software is installed or that the activity is unauthorized. Investigate the process responsible for the query and the host's activity to determine whether mining is occurring and whether it is approved.

## Triage and Response{% #triage-and-response %}

- Identify the process or service on `{{@ocsf.src_endpoint.ip}}` responsible for issuing the DNS query to `{{@ocsf.query.hostname}}`.
- Determine whether the host has unusually high CPU or GPU utilization consistent with cryptomining activity.
- Check whether the mining software was installed through an authorized software deployment or represents unapproved or malicious activity.
- Review recent process-execution history on `{{@ocsf.src_endpoint.ip}}` for known cryptomining binaries or scripts.
- Examine how the host may have been compromised, such as through a vulnerable public-facing service, malicious download, or supply-chain package.
- Determine whether the same pool domain has been queried by other hosts in the environment, indicating a broader compromise or unauthorized mining deployment.