DNS lookup for cryptocurrency mining pool

Classification:

attack

Tactic:

TA0040-impact

Technique:

T1496-resource-hijacking

Goal

Attackers often use compromised cloud infrastructure to mine cryptocurrency.

Strategy

Detect when a process performs a DNS lookup for a domain related to cryptomining.

Triage and response

{{@process.executable.name}} performed a DNS lookup for {{@dns.question.name}}

  1. Contain the host or container and roll back to a known good configuration.
  2. Review the process tree and determine the initial entry point.

Requires Agent version 7.36 or greater