Falco high stable other

Detect outbound connections to common miner pool ports

Miners usually connect to miner pools using standard ports, and this rule flags such activity. Important: Falco currently sends DNS requests to resolve miner pool domains, which could trigger other alerts. Prior to enabling this rule, it's advised to ensure whether this is acceptable for your environment. This rule is specifically disabled for that reason.

View Source

Detection Logic

net_miner_pool and not trusted_images_query_miner_domain_dns

Field Validations

Loading…

Comments (0)

Loading comments...