vicenteherrera · March 23, 2020 18:15
diff --git a/detect_outbound_connections_to_common_miner_pool_ports.yaml b/detect_outbound_connections_to_common_miner_pool_ports.yaml
 - rule: Detect outbound connections to common miner pool ports
  desc: Miners typically connect to miner pools on common ports.
  condition: net_miner_pool
  output: Outbound connection to IP/Port flagged by cryptoioc.ch (command=%proc.cmdline port=%fd.rport ip=%fd.rip container=%container.info image=%container.image.repository)
  priority: CRITICAL
  tags: [network, mitre_execution]
	- rule: Detect outbound connections to common miner pool ports
	desc: Miners typically connect to miner pools on common ports.
	condition: net_miner_pool
	output: Outbound connection to IP/Port flagged by cryptoioc.ch (command=%proc.cmdline port=%fd.rport ip=%fd.rip container=%container.info image=%container.image.repository)
	priority: CRITICAL
	tags: [network, mitre_execution]