Sigma high stable sigma

Network Communication With Crypto Mining Pool

Detects initiated network connections to crypto mining pools. It indicates that the system is likely infected with a crypto miner malware or is being used for crypto mining.

View Source

Detection Logic

{
  "selection": {
    "DestinationHostname": [
      "aeon-pool.com",
      "alimabi.cn",
      "ap.luckpool.net",
      "api.fastpool.xyz",
      "auto.c3pool.org",
      "awgoaigartnj-xmr.com",
      "backup.fastpool.xyz",
      "bcn.pool.minergate.com",
      "bcn.vip.pool.minergate.com",
      "bizxmr.cc",
      "bmpool.org",
      "bohemianpool.com",
      "byw.dscloud.me",
      "c3.wptask.cyou",
      "c3pool.org",
      "ca-aipg.miningocean.org",
      "ca-dynex.miningocean.org",
      "ca-neurai.miningocean.org",
      "ca-qrl.miningocean.org",
      "ca-upx.miningocean.org",
      "ca-zephyr.miningocean.org",
      "ca.minexmr.com",
      "ca.monero.herominers.com",
      "cbd.monerpool.org",
      "cbdv2.monerpool.org",
      "community-pools.mysrv.cloud",
      "covid19crypto.com",
      "cryptmonero.com",
      "crypto-pool.fr",
      "crypto-pool.info",
      "cryptominded.com",
      "cryptonight-hub.miningpoolhub.com",
      "d1pool.ddns.net",
      "d5pool.us",
      "daili01.monerpool.org",
      "de-aipg.miningocean.org",
      "de-dynex.miningocean.org",
      "de-zephyr.miningocean.org",
      "de.minexmr.com",
      "de.moneroocean.stream",
      "de.salvium.herominers.com",
      "de.zephyr.herominers.com",
      "dl.nbminer.com",
      "donate.graef.in",
      "donate.ssl.xmrig.com",
      "donate.v2.xmrig.com",
      "donate.xmrig.com",
      "donate2.graef.in",
      "drill.moneroworld.com",
      "dwarfpool.com",
      "emercoin.com",
      "emercoin.net",
      "emergate.net",
      "ethereumpool.co",
      "eu.luckpool.net",
      "eu.minerpool.pw",
      "f2pool.com",
      "fastpool.xyz",
      "fcn-xmr.pool.minergate.com",
      "fee.xmrig.com",
      "fi.moneroocean.stream",
      "fr-aipg.miningocean.org",
      "fr-dynex.miningocean.org",
      "fr-neurai.miningocean.org",
      "fr-qrl.miningocean.org",
      "fr-tarirx.luckypool.io",
      "fr-upx.miningocean.org",
      "fr-zephyr.miningocean.org",
      "fr.minexmr.com",
      "fr.moneroocean.stream",
      "friendspool.club",
      "ftp.fastpool.xyz",
      "gandalph3000.com",
      "googleminer.com",
      "grin.2miners.com",
      "gulf.moneroocean.stream",
      "hellominer.com",
      "herominers.com",
      "hk-aipg.miningocean.org",
      "hk-dynex.miningocean.org",
      "hk-neurai.miningocean.org",
      "hk-qrl.miningocean.org",
      "hk-upx.miningocean.org",
      "hk-zephyr.miningocean.org",
      "hns.f2pool.com",
      "huadong1-aeon.ppxxmr.com",
      "imap.fastpool.xyz",
      "iwanttoearn.money",
      "joulecoin.org",
      "jp.moneroocean.stream",
      "jw-js1.ppxxmr.com",
      "koto-pool.work",
      "kronecoin.org",
      "kryptex.network",
      "kubo.ultra-pool.com",
      "lhr.nbminer.com",
      "lhr3.nbminer.com",
      "linux.monerpool.org",
      "litecoinpool.org",
      "lokiturtle.herominers.com",
      "luckpool.net",
      "luckypool.io",
      "mail.fastpool.xyz",
      "masari.miner.rocks",
      "mine.aeon-pool.com",
      "mine.bmpool.org",
      "mine.c3pool.com",
      "mine.fastpool.xyz",
      "mine.lesliejust.is",
      "mine.moneropool.com",
      "mine.ppxxmr.com",
      "mine.zpool.ca",
      "mine1.ppxxmr.com",
      "minemonero.gq",
      "miner.ppxxmr.com",
      "miner.rocks",
      "minercircle.com",
      "minergate.com",
      "minerpool.pw",
      "minerrocks.com",
      "miners.pro",
      "minerxmr.ru",
      "minexmr.cn",
      "minexmr.com",
      "mining-help.ru",
      "mining.bittubeapp.com",
      "miningocean.org",
      "miningpoolhub.com",
      "miningrigrentals.com",
      "mixpools.org",
      "moner.monerpool.org",
      "moner1min.monerpool.org",
      "monero-master.crypto-pool.fr",
      "monero.crypto-pool.fr",
      "monero.hashvault.pro",
      "monero.herominers.com",
      "monero.lindon-pool.win",
      "monero.miners.pro",
      "monero.riefly.id",
      "monero.us.to",
      "monerocean.stream",
      "monerogb.com",
      "monerohash.com",
      "moneroocean.stream",
      "monerooceans.stream",
      "moneropool.com",
      "moneropool.nl",
      "monerorx.com",
      "monerpool.org",
      "moriaxmr.com",
      "mro.pool.minergate.com",
      "multipool.us",
      "myxmr.pw",
      "na.luckpool.net",
      "nanopool.org",
      "nbminer.com",
      "node.btx.tools",
      "node3.luckpool.net",
      "noobxmr.com",
      "p06.2miners.com",
      "pangolinminer.com",
      "pool-de.supportxmr.com",
      "pool-fr.supportxmr.com",
      "pool-nyc.supportxmr.com",
      "pool-phx.supportxmr.com",
      "pool.4i7i.com",
      "pool.armornetwork.org",
      "pool.awgoaigartnj-xmr.com",
      "pool.cortins.tk",
      "pool.gntl.co.uk",
      "pool.hashvault.pro",
      "pool.minergate.com",
      "pool.minexmr.com",
      "pool.minexmr.uk",
      "pool.monero.hashvault.pro",
      "pool.ppxxmr.com",
      "pool.somec.cc",
      "pool.support",
      "pool.supportxmr.com",
      "pool.usa-138.com",
      "pool.xmr.pt",
      "pool.xmrfast.com",
      "pool2.armornetwork.org",
      "poolchange.ppxxmr.com",
      "pooldd.com",
      "poolmining.org",
      "poolto.be",
      "pop.fastpool.xyz",
      "ppxvip1.ppxxmr.com",
      "ppxxmr.com",
      "prohash.net",
      "r.twotouchauthentication.online",
      "randomx.xmrig.com",
      "ratchetmining.com",
      "rx.unmineable.com",
      "salvium.herominers.com",
      "seed.emercoin.com",
      "seed.emercoin.net",
      "seed.emergate.net",
      "seed.kronecoin.org",
      "seed.titcoinpool.com",
      "seed.titcoins.info",
      "seed1.joulecoin.org",
      "seed2.joulecoin.org",
      "seed3.joulecoin.org",
      "seed4.joulecoin.org",
      "seed5.joulecoin.org",
      "seed6.joulecoin.org",
      "seed7.joulecoin.org",
      "seed8.joulecoin.org",
      "sg-aipg.miningocean.org",
      "sg-dynex.miningocean.org",
      "sg-neurai.miningocean.org",
      "sg-qrl.miningocean.org",
      "sg-upx.miningocean.org",
      "sg-zephyr.miningocean.org",
      "sg.minexmr.com",
      "sheepman.mine.bz",
      "siamining.com",
      "smtp.fastpool.xyz",
      "solarray.club",
      "solo-grin.2miners.com",
      "solo-grin.2miners.ru",
      "solo-xmr.2miners.com",
      "solo-xmr.2miners.ru",
      "soloxmr2min.dyndns.org",
      "sparechange.io",
      "ssl.fastpool.xyz",
      "sumokoin.minerrocks.com",
      "supportxmr.com",
      "suprnova.cc",
      "system-check.services",
      "system-update.info",
      "teracycle.net",
      "titcoinpool.com",
      "titcoins.info",
      "tpool.yiluzhuanqian.com",
      "trtl.cnpool.cc",
      "trtl.pool.mine2gether.com",
      "turtle.miner.rocks",
      "ultra-pool.com",
      "unmineable.com",
      "us-aipg.miningocean.org",
      "us-dynex.miningocean.org",
      "us-grin.2miners.com",
      "us-neurai.miningocean.org",
      "us-west.minexmr.com",
      "us-zephyr.miningocean.org",
      "usxmrpool.com",
      "viaxmr.com",
      "web.xmrpool.eu",
      "webservicepag.webhop.net",
      "winxmr.club",
      "x109.node.btx.tools",
      "xcn1.yiluzhuanqian.com",
      "xiazai.monerpool.org",
      "xiazai1.monerpool.org",
      "xmc.pool.minergate.com",
      "xmo.pool.minergate.com",
      "xmr-asia1.nanopool.org",
      "xmr-au1.nanopool.org",
      "xmr-eu1.nanopool.org",
      "xmr-eu2.nanopool.org",
      "xmr-jp1.nanopool.org",
      "xmr-us-east1.nanopool.org",
      "xmr-us-west1.nanopool.org",
      "xmr-us.suprnova.cc",
      "xmr-usa.dwarfpool.com",
      "xmr.2miners.com",
      "xmr.5b6b7b.ru",
      "xmr.748pz.net",
      "xmr.alimabi.cn",
      "xmr.bepooh.com",
      "xmr.bohemianpool.com",
      "xmr.crypto-pool.fr",
      "xmr.crypto-pool.info",
      "xmr.f2pool.com",
      "xmr.hashcity.org",
      "xmr.hex7e4.ru",
      "xmr.ip28.net",
      "xmr.kryptex.network",
      "xmr.monerpool.org",
      "xmr.mypool.online",
      "xmr.nanopool.org",
      "xmr.pool.gntl.co.uk",
      "xmr.pool.minergate.com",
      "xmr.poolto.be",
      "xmr.ppxxmr.com",
      "xmr.prohash.net",
      "xmr.simka.pw",
      "xmr.somec.cc",
      "xmr.suprnova.cc",
      "xmr.usa-138.com",
      "xmr.vip.pool.minergate.com",
      "xmr.yiluzhuanqian.com",
      "xmr1min.monerpool.org",
      "xmrf.520fjh.org",
      "xmrf.fjhan.club",
      "xmrfast.com",
      "xmrigcc.graef.in",
      "xmrminer.cc",
      "xmrpool.de",
      "xmrpool.eu",
      "xmrpool.me",
      "xmrpool.net",
      "xmrpool.xyz",
      "xx11m.monerpool.org",
      "xx11mv2.monerpool.org",
      "xxx.hex7e4.ru",
      "yes.fastpool.xyz",
      "zarabotaibitok.ru",
      "zeph-eu2.nanopool.org",
      "zeph.2miners.com",
      "zephyr.herominers.com",
      "zer0day.ru"
    ]
  },
  "condition": "selection"
}

False Positives

  • Unlikely

Field Validations

Loading…

Comments (0)

Loading comments...