Falco high stable other

Detect crypto miners using the Stratum protocol

Miners commonly specify the mining pool to connect to using a URI that starts with "stratum+tcp". However, this rule is highly specific to this technique, and matching command-line arguments can generally be bypassed quite easily.

View Source

Detection Logic

spawned_process and (proc.cmdline contains "stratum+tcp" or
     proc.cmdline contains "stratum2+tcp" or
     proc.cmdline contains "stratum+ssl" or
     proc.cmdline contains "stratum2+ssl")

Field Validations

Loading…

Comments (0)

Loading comments...