vicenteherrera · March 23, 2020 18:13
diff --git a/detect_crypto_miners_using_the_stratum_protocol.yaml b/detect_crypto_miners_using_the_stratum_protocol.yaml
 - rule: Detect crypto miners using the Stratum protocol
  desc: Miners typically specify the mining pool to connect to with a URI that begins with 'stratum+tcp'
  condition: spawned_process and proc.cmdline contains "stratum+tcp"
  output: Possible miner running (command=%proc.cmdline container=%container.info image=%container.image.repository)
  priority: CRITICAL
  tags: [process, mitre_execution]
	- rule: Detect crypto miners using the Stratum protocol
	desc: Miners typically specify the mining pool to connect to with a URI that begins with 'stratum+tcp'
	condition: spawned_process and proc.cmdline contains "stratum+tcp"
	output: Possible miner running (command=%proc.cmdline container=%container.info image=%container.image.repository)
	priority: CRITICAL
	tags: [process, mitre_execution]