Sigma high stable sigma
Network Communication With Crypto Mining Pool
Detects initiated network connections to crypto mining pools. It indicates that the system is likely infected with a crypto miner malware or is being used for crypto mining.
Detection Logic
{
"selection": {
"DestinationHostname": [
"aeon-pool.com",
"alimabi.cn",
"ap.luckpool.net",
"api.fastpool.xyz",
"auto.c3pool.org",
"awgoaigartnj-xmr.com",
"backup.fastpool.xyz",
"bcn.pool.minergate.com",
"bcn.vip.pool.minergate.com",
"bizxmr.cc",
"bmpool.org",
"bohemianpool.com",
"byw.dscloud.me",
"c3.wptask.cyou",
"c3pool.org",
"ca-aipg.miningocean.org",
"ca-dynex.miningocean.org",
"ca-neurai.miningocean.org",
"ca-qrl.miningocean.org",
"ca-upx.miningocean.org",
"ca-zephyr.miningocean.org",
"ca.minexmr.com",
"ca.monero.herominers.com",
"cbd.monerpool.org",
"cbdv2.monerpool.org",
"community-pools.mysrv.cloud",
"covid19crypto.com",
"cryptmonero.com",
"crypto-pool.fr",
"crypto-pool.info",
"cryptominded.com",
"cryptonight-hub.miningpoolhub.com",
"d1pool.ddns.net",
"d5pool.us",
"daili01.monerpool.org",
"de-aipg.miningocean.org",
"de-dynex.miningocean.org",
"de-zephyr.miningocean.org",
"de.minexmr.com",
"de.moneroocean.stream",
"de.salvium.herominers.com",
"de.zephyr.herominers.com",
"dl.nbminer.com",
"donate.graef.in",
"donate.ssl.xmrig.com",
"donate.v2.xmrig.com",
"donate.xmrig.com",
"donate2.graef.in",
"drill.moneroworld.com",
"dwarfpool.com",
"emercoin.com",
"emercoin.net",
"emergate.net",
"ethereumpool.co",
"eu.luckpool.net",
"eu.minerpool.pw",
"f2pool.com",
"fastpool.xyz",
"fcn-xmr.pool.minergate.com",
"fee.xmrig.com",
"fi.moneroocean.stream",
"fr-aipg.miningocean.org",
"fr-dynex.miningocean.org",
"fr-neurai.miningocean.org",
"fr-qrl.miningocean.org",
"fr-tarirx.luckypool.io",
"fr-upx.miningocean.org",
"fr-zephyr.miningocean.org",
"fr.minexmr.com",
"fr.moneroocean.stream",
"friendspool.club",
"ftp.fastpool.xyz",
"gandalph3000.com",
"googleminer.com",
"grin.2miners.com",
"gulf.moneroocean.stream",
"hellominer.com",
"herominers.com",
"hk-aipg.miningocean.org",
"hk-dynex.miningocean.org",
"hk-neurai.miningocean.org",
"hk-qrl.miningocean.org",
"hk-upx.miningocean.org",
"hk-zephyr.miningocean.org",
"hns.f2pool.com",
"huadong1-aeon.ppxxmr.com",
"imap.fastpool.xyz",
"iwanttoearn.money",
"joulecoin.org",
"jp.moneroocean.stream",
"jw-js1.ppxxmr.com",
"koto-pool.work",
"kronecoin.org",
"kryptex.network",
"kubo.ultra-pool.com",
"lhr.nbminer.com",
"lhr3.nbminer.com",
"linux.monerpool.org",
"litecoinpool.org",
"lokiturtle.herominers.com",
"luckpool.net",
"luckypool.io",
"mail.fastpool.xyz",
"masari.miner.rocks",
"mine.aeon-pool.com",
"mine.bmpool.org",
"mine.c3pool.com",
"mine.fastpool.xyz",
"mine.lesliejust.is",
"mine.moneropool.com",
"mine.ppxxmr.com",
"mine.zpool.ca",
"mine1.ppxxmr.com",
"minemonero.gq",
"miner.ppxxmr.com",
"miner.rocks",
"minercircle.com",
"minergate.com",
"minerpool.pw",
"minerrocks.com",
"miners.pro",
"minerxmr.ru",
"minexmr.cn",
"minexmr.com",
"mining-help.ru",
"mining.bittubeapp.com",
"miningocean.org",
"miningpoolhub.com",
"miningrigrentals.com",
"mixpools.org",
"moner.monerpool.org",
"moner1min.monerpool.org",
"monero-master.crypto-pool.fr",
"monero.crypto-pool.fr",
"monero.hashvault.pro",
"monero.herominers.com",
"monero.lindon-pool.win",
"monero.miners.pro",
"monero.riefly.id",
"monero.us.to",
"monerocean.stream",
"monerogb.com",
"monerohash.com",
"moneroocean.stream",
"monerooceans.stream",
"moneropool.com",
"moneropool.nl",
"monerorx.com",
"monerpool.org",
"moriaxmr.com",
"mro.pool.minergate.com",
"multipool.us",
"myxmr.pw",
"na.luckpool.net",
"nanopool.org",
"nbminer.com",
"node.btx.tools",
"node3.luckpool.net",
"noobxmr.com",
"p06.2miners.com",
"pangolinminer.com",
"pool-de.supportxmr.com",
"pool-fr.supportxmr.com",
"pool-nyc.supportxmr.com",
"pool-phx.supportxmr.com",
"pool.4i7i.com",
"pool.armornetwork.org",
"pool.awgoaigartnj-xmr.com",
"pool.cortins.tk",
"pool.gntl.co.uk",
"pool.hashvault.pro",
"pool.minergate.com",
"pool.minexmr.com",
"pool.minexmr.uk",
"pool.monero.hashvault.pro",
"pool.ppxxmr.com",
"pool.somec.cc",
"pool.support",
"pool.supportxmr.com",
"pool.usa-138.com",
"pool.xmr.pt",
"pool.xmrfast.com",
"pool2.armornetwork.org",
"poolchange.ppxxmr.com",
"pooldd.com",
"poolmining.org",
"poolto.be",
"pop.fastpool.xyz",
"ppxvip1.ppxxmr.com",
"ppxxmr.com",
"prohash.net",
"r.twotouchauthentication.online",
"randomx.xmrig.com",
"ratchetmining.com",
"rx.unmineable.com",
"salvium.herominers.com",
"seed.emercoin.com",
"seed.emercoin.net",
"seed.emergate.net",
"seed.kronecoin.org",
"seed.titcoinpool.com",
"seed.titcoins.info",
"seed1.joulecoin.org",
"seed2.joulecoin.org",
"seed3.joulecoin.org",
"seed4.joulecoin.org",
"seed5.joulecoin.org",
"seed6.joulecoin.org",
"seed7.joulecoin.org",
"seed8.joulecoin.org",
"sg-aipg.miningocean.org",
"sg-dynex.miningocean.org",
"sg-neurai.miningocean.org",
"sg-qrl.miningocean.org",
"sg-upx.miningocean.org",
"sg-zephyr.miningocean.org",
"sg.minexmr.com",
"sheepman.mine.bz",
"siamining.com",
"smtp.fastpool.xyz",
"solarray.club",
"solo-grin.2miners.com",
"solo-grin.2miners.ru",
"solo-xmr.2miners.com",
"solo-xmr.2miners.ru",
"soloxmr2min.dyndns.org",
"sparechange.io",
"ssl.fastpool.xyz",
"sumokoin.minerrocks.com",
"supportxmr.com",
"suprnova.cc",
"system-check.services",
"system-update.info",
"teracycle.net",
"titcoinpool.com",
"titcoins.info",
"tpool.yiluzhuanqian.com",
"trtl.cnpool.cc",
"trtl.pool.mine2gether.com",
"turtle.miner.rocks",
"ultra-pool.com",
"unmineable.com",
"us-aipg.miningocean.org",
"us-dynex.miningocean.org",
"us-grin.2miners.com",
"us-neurai.miningocean.org",
"us-west.minexmr.com",
"us-zephyr.miningocean.org",
"usxmrpool.com",
"viaxmr.com",
"web.xmrpool.eu",
"webservicepag.webhop.net",
"winxmr.club",
"x109.node.btx.tools",
"xcn1.yiluzhuanqian.com",
"xiazai.monerpool.org",
"xiazai1.monerpool.org",
"xmc.pool.minergate.com",
"xmo.pool.minergate.com",
"xmr-asia1.nanopool.org",
"xmr-au1.nanopool.org",
"xmr-eu1.nanopool.org",
"xmr-eu2.nanopool.org",
"xmr-jp1.nanopool.org",
"xmr-us-east1.nanopool.org",
"xmr-us-west1.nanopool.org",
"xmr-us.suprnova.cc",
"xmr-usa.dwarfpool.com",
"xmr.2miners.com",
"xmr.5b6b7b.ru",
"xmr.748pz.net",
"xmr.alimabi.cn",
"xmr.bepooh.com",
"xmr.bohemianpool.com",
"xmr.crypto-pool.fr",
"xmr.crypto-pool.info",
"xmr.f2pool.com",
"xmr.hashcity.org",
"xmr.hex7e4.ru",
"xmr.ip28.net",
"xmr.kryptex.network",
"xmr.monerpool.org",
"xmr.mypool.online",
"xmr.nanopool.org",
"xmr.pool.gntl.co.uk",
"xmr.pool.minergate.com",
"xmr.poolto.be",
"xmr.ppxxmr.com",
"xmr.prohash.net",
"xmr.simka.pw",
"xmr.somec.cc",
"xmr.suprnova.cc",
"xmr.usa-138.com",
"xmr.vip.pool.minergate.com",
"xmr.yiluzhuanqian.com",
"xmr1min.monerpool.org",
"xmrf.520fjh.org",
"xmrf.fjhan.club",
"xmrfast.com",
"xmrigcc.graef.in",
"xmrminer.cc",
"xmrpool.de",
"xmrpool.eu",
"xmrpool.me",
"xmrpool.net",
"xmrpool.xyz",
"xx11m.monerpool.org",
"xx11mv2.monerpool.org",
"xxx.hex7e4.ru",
"yes.fastpool.xyz",
"zarabotaibitok.ru",
"zeph-eu2.nanopool.org",
"zeph.2miners.com",
"zephyr.herominers.com",
"zer0day.ru"
]
},
"condition": "selection"
} False Positives
- ⚠ Unlikely
Field Validations
Loading…
Comments (0)
Loading comments...