Which SIEM platforms have a T1496 detection rule?

df00tech provides T1496 (Resource Hijacking) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What severity and confidence is the T1496 detection?

The T1496 detection is rated high severity with high confidence.

What are common false positives for T1496?

Common false positives for T1496 include: Legitimate cryptocurrency wallet software or personal mining on developer endpoints (rare in corporate environments); Security researchers or red team operators running miner tools in authorized lab environments; Network performance testing tools connecting to high-numbered ports that overlap with mining pool ranges.

T1496

Resource Hijacking

Q: What data sources are required to detect Resource Hijacking (T1496)?

Detecting Resource Hijacking requires the following data sources: Process: Process Creation, Network Traffic: Network Connection Creation, Command: Command Execution, Microsoft Defender for Endpoint.

Impact Last updated: April 14, 2026

Adversaries may leverage the resources of co-opted systems to complete resource-intensive tasks, which may impact system and/or hosted service availability. Resource hijacking includes cryptocurrency mining (cryptojacking), selling network bandwidth to proxy networks (proxyjacking), generating SMS traffic for profit, and abusing cloud-based messaging or compute services. Adversaries often deploy miners via initial access (phishing, exploitation), lateral movement, or compromised cloud credentials, and may use rootkits or process hollowing to hide mining activity.

What is T1496 Resource Hijacking?

Resource Hijacking (T1496) maps to the Impact tactic — the adversary is trying to manipulate, interrupt, or destroy your systems and data in MITRE ATT&CK.

This page provides production-ready detection logic for Resource Hijacking, covering the data sources and telemetry it touches: Process: Process Creation, Network Traffic: Network Connection Creation, Command: Command Execution, Microsoft Defender for Endpoint. The queries below are rated high severity at high confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.

MITRE ATT&CK

Tactic: Impact
Technique: T1496 Resource Hijacking
Canonical reference: https://attack.mitre.org/techniques/T1496/

Microsoft Sentinel / Defender

kusto

let KnownMinerProcessNames = dynamic([
  "xmrig", "xmrig.exe", "minerd", "minerd.exe", "cpuminer", "cpuminer.exe",
  "ethminer", "ethminer.exe", "nheqminer", "nheqminer.exe", "t-rex", "t-rex.exe",
  "nbminer", "nbminer.exe", "phoenixminer", "lolminer", "gminer", "gminer.exe",
  "bfgminer", "cgminer", "cgminer.exe", "claymore", "excavator", "teamredminer",
  "kawpowminer", "poolminer", "stratum", "xmr-stak", "xmr-stak.exe"
]);
let MiningPoolPorts = dynamic([3333, 4444, 5555, 7777, 9999, 14444, 45700, 3256, 8008, 1080, 9200, 14433, 20536]);
let MiningPoolDomains = dynamic([
  "pool.minexmr.com", "xmrpool.eu", "pool.supportxmr.com", "monerohash.com",
  "nanopool.org", "f2pool.com", "ethermine.org", "2miners.com", "hiveon.net",
  "nicehash.com", "prohashing.com", "antpool.com", "btc.com", "viabtc.com",
  "zpool.ca", "coinhive.com", "jsecoin.com", "crypto-loot.com"
]);
let MinerCommandPatterns = dynamic([
  "stratum+tcp", "stratum+ssl", "stratum2+tcp",
  "-o pool.", "--url=", "-u wallet.", "--wallet",
  "--donate-level", "--coin xmr", "--coin monero",
  "mining.subscribe", "mining.authorize"
]);
// Branch 1: Known miner process names
let MinerProcessEvents = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName has_any (KnownMinerProcessNames)
   or ProcessCommandLine has_any (MinerCommandPatterns)
| extend DetectionSource = "MinerProcess"
| extend RiskScore = 90
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
          InitiatingProcessFileName, InitiatingProcessCommandLine,
          DetectionSource, RiskScore;
// Branch 2: Network connections to mining pool ports/domains
let MinerNetworkEvents = DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemotePort in (MiningPoolPorts)
   or RemoteUrl has_any (MiningPoolDomains)
   or RemoteIPType == "Public"
| where InitiatingProcessFileName !in~ ("chrome.exe", "msedge.exe", "firefox.exe", "iexplore.exe", "outlook.exe", "teams.exe")
| extend DetectionSource = "MinerNetworkConn"
| extend RiskScore = 70
| project Timestamp, DeviceName, AccountName = InitiatingProcessAccountName,
          FileName = InitiatingProcessFileName,
          ProcessCommandLine = InitiatingProcessCommandLine,
          InitiatingProcessFileName, InitiatingProcessCommandLine,
          DetectionSource, RiskScore;
// Branch 3: Suspicious process spawning miner-related child processes
let MinerChildProcess = DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "bash", "sh")
| where FileName has_any (KnownMinerProcessNames)
   or ProcessCommandLine has_any (MinerCommandPatterns)
| extend DetectionSource = "MinerSpawnedByLOLBin"
| extend RiskScore = 95
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
          InitiatingProcessFileName, InitiatingProcessCommandLine,
          DetectionSource, RiskScore;
// Union all branches
union MinerProcessEvents, MinerNetworkEvents, MinerChildProcess
| summarize RiskScore=max(RiskScore), DetectionSources=make_set(DetectionSource),
            CommandLines=make_set(ProcessCommandLine)
  by Timestamp, DeviceName, AccountName, FileName, InitiatingProcessFileName
| sort by RiskScore desc, Timestamp desc

Detects resource hijacking (cryptomining, proxyjacking) across three signal branches: (1) known miner process names and command-line patterns including stratum protocol arguments and wallet parameters; (2) outbound network connections to common mining pool ports (3333, 4444, 5555, etc.) and known pool domains; (3) scripting engines or LOLBins spawning miner processes. Results are unioned and deduplicated with a risk score to help analysts prioritize. Uses DeviceProcessEvents and DeviceNetworkEvents from Microsoft Defender for Endpoint.

high severity high confidence

Data Sources

Process: Process Creation Network Traffic: Network Connection Creation Command: Command Execution Microsoft Defender for Endpoint

Required Tables

DeviceProcessEvents DeviceNetworkEvents

False Positives

Legitimate cryptocurrency wallet software or personal mining on developer endpoints (rare in corporate environments)
Security researchers or red team operators running miner tools in authorized lab environments
Network performance testing tools connecting to high-numbered ports that overlap with mining pool ranges
Proxy or VPN client software using ports that coincidentally overlap with known mining pool ports
Penetration testing scripts containing stratum protocol strings for mining simulation exercises

Splunk

spl

index=* (
  sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational"
  OR sourcetype="WinEventLog:Security"
  OR sourcetype="syslog"
)
(
  (
    (EventCode=1 OR EventCode=4688)
    (
      Image IN ("*xmrig*", "*minerd*", "*cpuminer*", "*ethminer*", "*nheqminer*",
                "*t-rex*", "*nbminer*", "*phoenixminer*", "*lolminer*", "*gminer*",
                "*bfgminer*", "*cgminer*", "*xmr-stak*", "*poolminer*")
      OR Process_Name IN ("*xmrig*", "*minerd*", "*cpuminer*", "*ethminer*")
      OR CommandLine IN ("*stratum+tcp*", "*stratum+ssl*", "*stratum2+tcp*",
                         "*mining.subscribe*", "*mining.authorize*",
                         "*--donate-level*", "*--coin xmr*", "*--coin monero*")
      OR CommandLine IN ("*-o pool.*", "*--url=*pool*", "*-u wallet.*", "*--wallet*")
    )
  )
  OR
  (
    EventCode=3
    (DestinationPort IN ("3333", "4444", "5555", "7777", "9999", "14444", "45700", "3256", "14433", "20536"))
    NOT (DestinationIp="10.*" OR DestinationIp="172.16.*" OR DestinationIp="192.168.*" OR DestinationIp="127.*")
    NOT (Image IN ("*chrome.exe", "*msedge.exe", "*firefox.exe", "*iexplore.exe", "*outlook.exe", "*teams.exe"))
  )
)
| eval EventType=case(
    EventCode=1 OR EventCode=4688, "ProcessCreate",
    EventCode=3, "NetworkConnect",
    true(), "Unknown"
  )
| eval MinerProcess=if(
    match(lower(Image), "(xmrig|minerd|cpuminer|ethminer|nheqminer|t-rex|nbminer|phoenixminer|lolminer|gminer|bfgminer|cgminer|xmr-stak|poolminer)"),
    1, 0
  )
| eval MinerCommandLine=if(
    match(lower(CommandLine), "(stratum\+tcp|stratum\+ssl|mining\.subscribe|mining\.authorize|donate-level|--coin xmr|--coin monero|-o pool\.|--wallet)"),
    1, 0
  )
| eval MiningPoolPort=if(EventCode=3 AND DestinationPort IN ("3333","4444","5555","7777","9999","14444","45700","14433","20536"), 1, 0)
| eval SpawnedByScript=if(
    match(lower(ParentImage), "(powershell|cmd\.exe|wscript|cscript|mshta|bash|sh)") AND MinerProcess=1,
    1, 0
  )
| eval RiskScore=case(
    SpawnedByScript=1, 95,
    MinerProcess=1 AND MinerCommandLine=1, 90,
    MinerProcess=1, 80,
    MinerCommandLine=1, 75,
    MiningPoolPort=1, 70,
    true(), 50
  )
| where RiskScore >= 70
| table _time, host, User, Image, CommandLine, ParentImage, ParentCommandLine,
        DestinationIp, DestinationPort, EventType,
        MinerProcess, MinerCommandLine, MiningPoolPort, SpawnedByScript, RiskScore
| sort - RiskScore _time

Detects cryptocurrency mining and resource hijacking using Sysmon Event ID 1 (Process Create), Security Event ID 4688, and Sysmon Event ID 3 (Network Connection). Evaluates process image names, command-line stratum protocol arguments, and outbound connections to known mining pool ports. Calculates a RiskScore to prioritize events — highest risk for miners spawned by script interpreters or LOLBins (95), lowest for bare port-based network detections (70). Filters common browser processes to reduce noise on mining pool ports.

high severity high confidence

Data Sources

Process: Process Creation Network Traffic: Network Connection Creation Command: Command Execution Sysmon Event IDs 1 and 3

Required Sourcetypes

XmlWinEventLog:Microsoft-Windows-Sysmon/Operational WinEventLog:Security

False Positives

Legitimate cryptocurrency wallet software or personal mining on developer endpoints
Security researchers or red team operators running miner tools in authorized lab environments
Network performance testing tools using ports that overlap with known mining pool ranges
Proxy or VPN clients that connect on ports coincidentally matching mining pool ranges
Penetration testing toolkits with stratum protocol simulation components

Elastic Security (EQL)

eql

any where
(
  (
    event.category == "process" and event.type == "start" and
    (
      process.name in~ ("xmrig","xmrig.exe","minerd","minerd.exe","cpuminer","cpuminer.exe","ethminer","ethminer.exe","nheqminer","nheqminer.exe","t-rex","t-rex.exe","nbminer","nbminer.exe","phoenixminer","lolminer","gminer","gminer.exe","bfgminer","cgminer","cgminer.exe","xmr-stak","xmr-stak.exe","poolminer","kawpowminer","teamredminer") or
      process.command_line like~ ("*stratum+tcp*","*stratum+ssl*","*stratum2+tcp*","*--donate-level*","*--coin xmr*","*--coin monero*","*-o pool.*","*--url=*","*-u wallet.*","*--wallet*","*mining.subscribe*","*mining.authorize*")
    )
  ) or
  (
    event.category == "network" and event.type in ("connection","start") and
    destination.port in (3333,4444,5555,7777,9999,14444,45700,3256,14433,20536) and
    not cidrmatch(destination.ip,"10.0.0.0/8","172.16.0.0/12","192.168.0.0/16","127.0.0.0/8") and
    not process.name in~ ("chrome.exe","msedge.exe","firefox.exe","iexplore.exe","outlook.exe","teams.exe")
  )
)

Detects T1496 Resource Hijacking across process and network event categories using ECS fields. Branch 1 matches known cryptominer executable names via process.name. Branch 2 matches stratum protocol URIs, pool connection flags, and coin specifiers via process.command_line wildcard patterns. Branch 3 identifies outbound connections to mining pool ports excluding RFC1918 and browser processes. Requires Elastic Endpoint Security or Winlogbeat+Sysmon for process telemetry and Elastic Endpoint or network integration for connection events.

high severity high confidence

Data Sources

Elastic Endpoint Security Elastic Agent endpoint integration Winlogbeat with Sysmon Auditbeat (Linux)

Required Tables

logs-endpoint.events.process-* logs-endpoint.events.network-* winlogbeat-* auditbeat-*

False Positives

Authorized cryptocurrency mining rigs operating in a managed mining farm where xmrig or nbminer is sanctioned business software
Blockchain developers testing stratum protocol implementations or running local testnet mining nodes during Web3 application development
Security research sandboxes intentionally executing miner samples for detection engineering validation or incident response training

IBM QRadar (AQL)

sql

SELECT
  DATEFORMAT(starttime,'yyyy-MM-dd HH:mm:ss') AS "Event Time",
  sourceip AS "Host IP",
  username AS "User",
  "Process Name" AS "Process",
  "Command" AS "Command Line",
  "Parent Process Name" AS "Parent Process",
  destinationip AS "Destination IP",
  destinationport AS "Destination Port",
  QIDNAME(qid) AS "Event Name",
  LOGSOURCENAME(logsourceid) AS "Log Source",
  CASE
    WHEN LOWER("Process Name") ILIKE ANY ('%xmrig%','%minerd%','%cpuminer%','%ethminer%','%nheqminer%','%nbminer%','%phoenixminer%','%lolminer%','%gminer%','%bfgminer%','%cgminer%','%xmr-stak%','%poolminer%','%t-rex%','%kawpowminer%','%teamredminer%')
      AND LOWER("Parent Process Name") ILIKE ANY ('%powershell%','%cmd.exe%','%wscript%','%cscript%','%mshta%','%bash%') THEN 95
    WHEN LOWER("Process Name") ILIKE ANY ('%xmrig%','%minerd%','%cpuminer%','%ethminer%','%nbminer%','%lolminer%','%gminer%','%cgminer%','%xmr-stak%','%poolminer%')
      AND LOWER("Command") ILIKE ANY ('%stratum%','%--wallet%','%mining.subscribe%','%mining.authorize%') THEN 90
    WHEN LOWER("Process Name") ILIKE ANY ('%xmrig%','%minerd%','%cpuminer%','%ethminer%','%nheqminer%','%nbminer%','%phoenixminer%','%lolminer%','%gminer%','%bfgminer%','%cgminer%','%xmr-stak%','%poolminer%','%t-rex%','%kawpowminer%','%teamredminer%') THEN 80
    WHEN LOWER("Command") ILIKE ANY ('%stratum+tcp%','%stratum+ssl%','%--donate-level%','%--coin xmr%','%--coin monero%','%-o pool.%','%--wallet%','%mining.subscribe%') THEN 75
    WHEN destinationport IN (3333,4444,5555,7777,9999,14444,45700,3256,14433,20536)
      AND NOT INCIDR(destinationip,'10.0.0.0/8')
      AND NOT INCIDR(destinationip,'172.16.0.0/12')
      AND NOT INCIDR(destinationip,'192.168.0.0/16')
      AND NOT INCIDR(destinationip,'127.0.0.0/8') THEN 70
    ELSE 50
  END AS "Risk Score"
FROM events
WHERE
  LOWER("Process Name") ILIKE ANY ('%xmrig%','%minerd%','%cpuminer%','%ethminer%','%nheqminer%','%t-rex%','%nbminer%','%phoenixminer%','%lolminer%','%gminer%','%bfgminer%','%cgminer%','%xmr-stak%','%poolminer%','%kawpowminer%','%teamredminer%')
  OR LOWER("Command") ILIKE ANY ('%stratum+tcp%','%stratum+ssl%','%stratum2+tcp%','%--donate-level%','%--coin xmr%','%--coin monero%','%-o pool.%','%--url=%pool%','%-u wallet.%','%--wallet%','%mining.subscribe%','%mining.authorize%')
  OR (
    destinationport IN (3333,4444,5555,7777,9999,14444,45700,3256,14433,20536)
    AND NOT INCIDR(destinationip,'10.0.0.0/8')
    AND NOT INCIDR(destinationip,'172.16.0.0/12')
    AND NOT INCIDR(destinationip,'192.168.0.0/16')
    AND NOT INCIDR(destinationip,'127.0.0.0/8')
    AND NOT LOWER("Process Name") ILIKE ANY ('%chrome.exe%','%msedge.exe%','%firefox.exe%','%iexplore.exe%','%outlook.exe%','%teams.exe%')
  )
LAST 1440 MINUTES
ORDER BY "Risk Score" DESC, starttime DESC

Detects T1496 Resource Hijacking in QRadar AQL against normalized Windows and Linux event properties. Matches known miner process names in the DSM-normalized Process Name property, mining command-line patterns in the Command property, and outbound connections to mining pool ports via destinationport with CIDR exclusions for RFC1918 space. Risk scoring escalates from LOLBin-spawned miners (95) to standalone network port matches (70). Requires Windows Security, Sysmon, and Linux OS DSMs configured to normalize Process Name, Command, and Parent Process Name custom event properties.

high severity high confidence

Data Sources

IBM QRadar SIEM Windows Security Event Log DSM Microsoft Sysmon DSM Linux OS DSM QRadar Network Insights (for flow-based port detection)

Required Tables

events

False Positives

Authorized mining infrastructure on known hosts — add those hostnames to a QRadar reference set and prepend NOT sourceip INREFERENCESET(ref_set_name) to the WHERE clause
Penetration testing engagements simulating miner deployment to validate detection coverage — coordinate pre-approved test windows and filter by tester source IP
Portfolio or crypto trading applications that maintain persistent connections to exchange APIs on ports overlapping with mining pool ports such as 9999 or 4444

Sumo Logic CSE

sql

_index=sec_record_*
| where metadata_deviceEventId in ("1","4688","3")
| where (
    (metadata_deviceEventId in ("1","4688") and (
      matches(baseImage,"(?i)(xmrig|minerd|cpuminer|ethminer|nheqminer|t-rex|nbminer|phoenixminer|lolminer|gminer|bfgminer|cgminer|xmr-stak|poolminer|kawpowminer|teamredminer)(\\.exe)?")
      or matches(commandLine,"(?i)(stratum\\+(tcp|ssl)|stratum2\\+tcp|--donate-level|--coin[ =](xmr|monero)|-o pool\\.|--url=|--wallet|mining\\.(subscribe|authorize))")
    ))
    or (metadata_deviceEventId = "3"
      and dstPort in ("3333","4444","5555","7777","9999","14444","45700","3256","14433","20536")
      and not matches(dstIp,"^(10\\.|172\\.(1[6-9]|2[0-9]|3[01])\\.|192\\.168\\.|127\\.)")
      and not matches(baseImage,"(?i)(chrome\\.exe|msedge\\.exe|firefox\\.exe|iexplore\\.exe|outlook\\.exe|teams\\.exe)")
    )
  )
| eval RiskScore = if(
    matches(parentBaseImage,"(?i)(powershell|cmd\\.exe|wscript|cscript|mshta|bash|sh)")
    and matches(baseImage,"(?i)(xmrig|minerd|cpuminer|ethminer|nheqminer|nbminer|lolminer|gminer|cgminer|xmr-stak|poolminer)"),
    95,
    if(matches(baseImage,"(?i)(xmrig|minerd|cpuminer|ethminer|nheqminer|nbminer|lolminer|gminer|cgminer|xmr-stak|poolminer)")
       and matches(commandLine,"(?i)(stratum|wallet|mining)"),
       90,
       if(matches(baseImage,"(?i)(xmrig|minerd|cpuminer|ethminer|nheqminer|nbminer|lolminer|gminer|cgminer|xmr-stak|poolminer)"),80,70)
    )
  )
| where RiskScore >= 70
| fields device_hostname, user_username, baseImage, commandLine, parentBaseImage, dstIp, dstPort, RiskScore, metadata_deviceEventId
| sort by RiskScore desc

Detects T1496 Resource Hijacking against the Sumo Logic Cloud SIEM Enterprise normalized record index (sec_record_*). Queries Sysmon EID 1 / Windows EID 4688 process creation records for known miner executable names and stratum protocol command-line patterns via the CSE normalized baseImage and commandLine fields. Queries Sysmon EID 3 network connection records for outbound mining pool port connections via dstPort with RFC1918 CIDR and browser exclusions. Risk scores LOLBin-spawned miners at 95, miners with stratum args at 90, standalone miner names at 80, and port-only matches at 70. Requires Sumo Logic CSE with Windows and Sysmon event sources configured.

high severity high confidence

Data Sources

Sumo Logic Cloud SIEM Enterprise Windows Event Log via Sumo Logic Installed Collector Sysmon via Sumo Logic Installed Collector Linux Syslog via Sumo Logic collector

Required Tables

sec_record_*

False Positives

Mining software legitimately deployed on organization-owned mining hardware — create a CSE suppression rule targeting device_hostname values for approved mining hosts
Cryptocurrency daemon software such as monerod or bitcoind running on authorized endpoints that trigger on port or command-line keyword matches
Red team or purple team exercises executing miner binaries in sandboxed environments as part of detection validation — coordinate suppression windows with the security team

Google Chronicle / SecOps

yaral

rule t1496_cryptominer_process_execution {
  meta:
    author = "Detection Engineering"
    description = "Detects known cryptominer process names and mining command-line patterns. T1496 Resource Hijacking."
    mitre_attack_tactic = "Impact"
    mitre_attack_technique = "T1496"
    severity = "HIGH"
    confidence = "HIGH"

  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    (
      re.regex($e.target.process.file.full_path,
        `(?i)(xmrig|minerd|cpuminer|ethminer|nheqminer|t-rex|nbminer|phoenixminer|lolminer|gminer|bfgminer|cgminer|xmr-stak|poolminer|kawpowminer|teamredminer)(\.exe)?$`) or
      re.regex($e.target.process.command_line,
        `(?i)(stratum\+(tcp|ssl)|stratum2\+tcp|--donate-level|--coin[ =](xmr|monero)|-o pool\.|--url=.*pool|--wallet|mining\.(subscribe|authorize))`)
    )

  condition:
    $e
}

rule t1496_cryptominer_lolbin_spawn {
  meta:
    author = "Detection Engineering"
    description = "Detects cryptominer process spawned by scripting LOLBins, indicating script-based dropper activity. T1496 + T1059."
    mitre_attack_tactic = "Impact"
    mitre_attack_technique = "T1496"
    severity = "CRITICAL"
    confidence = "HIGH"

  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    re.regex($e.principal.process.file.full_path,
      `(?i)(cmd\.exe|powershell\.exe|wscript\.exe|cscript\.exe|mshta\.exe|bash|sh)$`)
    (
      re.regex($e.target.process.file.full_path,
        `(?i)(xmrig|minerd|cpuminer|ethminer|nheqminer|t-rex|nbminer|phoenixminer|lolminer|gminer|bfgminer|cgminer|xmr-stak|poolminer|kawpowminer|teamredminer)(\.exe)?$`) or
      re.regex($e.target.process.command_line,
        `(?i)(stratum\+(tcp|ssl)|--donate-level|--coin[ =](xmr|monero)|-o pool\.|--wallet|mining\.(subscribe|authorize))`)
    )

  condition:
    $e
}

rule t1496_cryptominer_mining_pool_network {
  meta:
    author = "Detection Engineering"
    description = "Detects outbound connections to known cryptocurrency mining pool ports, excluding browsers. T1496 Resource Hijacking."
    mitre_attack_tactic = "Impact"
    mitre_attack_technique = "T1496"
    severity = "HIGH"
    confidence = "MEDIUM"

  events:
    $net.metadata.event_type = "NETWORK_CONNECTION"
    $net.target.port in (3333, 4444, 5555, 7777, 9999, 14444, 45700, 3256, 14433, 20536)
    not net.ip_in_range_cidr($net.target.ip, "10.0.0.0/8")
    not net.ip_in_range_cidr($net.target.ip, "172.16.0.0/12")
    not net.ip_in_range_cidr($net.target.ip, "192.168.0.0/16")
    not net.ip_in_range_cidr($net.target.ip, "127.0.0.0/8")
    not re.regex($net.principal.process.file.full_path,
      `(?i)(chrome\.exe|msedge\.exe|firefox\.exe|iexplore\.exe|outlook\.exe|teams\.exe)$`)

  condition:
    $net
}

Three Chronicle YARA-L 2.0 rules covering T1496 Resource Hijacking. Rule 1 (HIGH) matches PROCESS_LAUNCH events for known miner executable names and stratum command-line patterns using UDM target.process fields. Rule 2 (CRITICAL) detects miners spawned by LOLBins using UDM principal.process for the parent and target.process for the child — the highest-fidelity signal. Rule 3 (MEDIUM confidence) detects NETWORK_CONNECTION events to mining pool ports with CIDR exclusions for RFC1918 and browser process filtering via principal.process. Deploy all three rules for full behavioral coverage across the kill chain.

high severity high confidence

Data Sources

Google Chronicle SIEM Chronicle UDM (Unified Data Model) Windows Event Forwarding with Sysmon via Chronicle forwarder CrowdStrike Falcon Chronicle feed Carbon Black Cloud Chronicle feed

Required Tables

UDM Events (PROCESS_LAUNCH, NETWORK_CONNECTION)

False Positives

Authorized mining workloads in GCP or on-premises with valid business justification — add host principal values to a Chronicle reference list and filter with $e.principal.hostname in %approved_mining_hosts
Cryptocurrency development toolchains using stratum protocol for local mining simulations during blockchain application development or testnet validation
VPN or tunneling applications that use ports 3333 or 4444 for their control channel, triggering the network rule without process context to disambiguate — validate with principal.process and target.ip enrichment

CrowdStrike LogScale (CQL)

cql

#event_simpleName in [ProcessRollup2, SyntheticProcessRollup2, NetworkConnectIP4]
| MinerProcess := FileName = /(?i)\b(xmrig|minerd|cpuminer|ethminer|nheqminer|t-rex|nbminer|phoenixminer|lolminer|gminer|bfgminer|cgminer|xmr-stak|poolminer|kawpowminer|teamredminer)(\.exe)?\b/
| MinerCmdLine := CommandLine = /(?i)(stratum\+(tcp|ssl)|stratum2\+tcp|--donate-level|--coin[ =](xmr|monero)|-o\s+pool\.|--url=.*pool|--wallet|mining\.(subscribe|authorize))/
| MiningPoolPort := RemotePort in [3333, 4444, 5555, 7777, 9999, 14444, 45700, 3256, 14433, 20536]
| SpawnedByLOLBin := MinerProcess = true AND ParentBaseFileName = /(?i)\b(cmd\.exe|powershell\.exe|wscript\.exe|cscript\.exe|mshta\.exe|bash|sh)\b/
| filter(MinerProcess = true OR MinerCmdLine = true OR MiningPoolPort = true)
| case {
    SpawnedByLOLBin = true | RiskScore := 95;
    MinerProcess = true AND MinerCmdLine = true | RiskScore := 90;
    MinerProcess = true | RiskScore := 80;
    MinerCmdLine = true | RiskScore := 75;
    MiningPoolPort = true | RiskScore := 70;
    * | RiskScore := 50;
  }
| select([ComputerName, UserName, FileName, CommandLine, ParentBaseFileName, RemoteAddress, RemotePort, MinerProcess, MinerCmdLine, MiningPoolPort, SpawnedByLOLBin, RiskScore, @timestamp])
| sort(RiskScore, order=desc)

Detects T1496 Resource Hijacking using CrowdStrike Falcon LogScale CQL against Falcon Insight EDR telemetry. Queries ProcessRollup2 and SyntheticProcessRollup2 events for known miner executable names via FileName regex and stratum protocol command-line patterns via CommandLine regex. Queries NetworkConnectIP4 events for outbound connections to mining pool ports via RemotePort set membership. Computes a risk score in a case block: LOLBin-spawned miners score 95, miners with stratum args score 90, standalone miner process names score 80, command-line patterns only score 75, and mining pool port connections score 70. Requires Falcon Insight with process and network telemetry collection enabled.

high severity high confidence

Data Sources

CrowdStrike Falcon Insight EDR CrowdStrike Falcon LogScale (Next-Gen SIEM) Falcon sensor with network telemetry enabled

Required Tables

ProcessRollup2 SyntheticProcessRollup2 NetworkConnectIP4

False Positives

Authorized mining hosts with Falcon sensor deployed — add a filter clause such as ComputerName != /approved-miner-host-pattern/ or use a Falcon exclusion policy scoped to those machine groups
Legitimate use of ports 3333 or 4444 by internal security tools, protocol analyzers, or services that share mining pool port ranges — correlate RemoteAddress against threat intel before escalating NetworkConnectIP4 matches
Open-source cryptocurrency wallet software such as Electrum or Exodus that connects to ElectrumX or blockchain nodes on ports overlapping with the mining pool port list

Sigma rule & cross-platform mapping

The detection logic for Resource Hijacking (T1496) above is provided in a vendor-neutral form so you can deploy it on any SIEM. The same logic is shipped here as native KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the following logsource:

logsource:
  category: process_creation
  product: windows

Browse the community-maintained Sigma rules for this technique:

SigmaHQ rules for T1496 Sigma rules on detection.fyi

Platform-specific guides for T1496

Detect in Microsoft Sentinel (KQL) Detect in Splunk (SPL) Detect in Elastic Security (Elastic) Detect in IBM QRadar (QRadar) Detect in Sumo Logic CSE (Sumo) Detect in Google Chronicle (YARA-L) Detect in CrowdStrike LogScale (LogScale)

Last updated: 2026-04-14 Research depth: deep

References (6)

Testing Methodology

Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

Test 1XMRig Miner Execution with Stratum Protocol Arguments
Expected signal: Sysmon Event ID 1 (or Security Event ID 4688): Process Create for cmd.exe with CommandLine containing 'stratum+tcp', 'pool.minexmr.com', '--donate-level', and '--coin xmr'. The echo command generates no network connection but the command-line telemetry fully triggers the detection.
Test 2Linux Miner Binary Dropped to /tmp and Executed
Expected signal: Auditd or Sysmon for Linux: file creation event for /tmp/xmrig (execve or open syscall), process execution event showing Image=/tmp/xmrig. Linux audit log: SYSCALL records for execve with /tmp/xmrig. EDR: DeviceFileEvents for /tmp/xmrig creation, DeviceProcessEvents for /tmp/xmrig execution.
Test 3Outbound Connection to Mining Pool Port
Expected signal: Sysmon Event ID 3: Network Connection with DestinationPort=3333, Image=powershell.exe, DestinationIp=127.0.0.1. The connection fails but the attempt is logged. In production, the query filters 127.0.0.1 — modify DestinationIp to an external test IP if available in your lab.
Test 4Miner Persistence via Scheduled Task
Expected signal: Security Event ID 4698: A scheduled task was created, with TaskContent XML showing the action command line including 'stratum+tcp'. Sysmon Event ID 1 on next logon: cmd.exe executing with the stratum-like command line. Registry: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks entry created.
Test 5Cloud Credential Abuse Simulation (AWS CLI Reconnaissance)
Expected signal: AWS CloudTrail: DescribeInstances and DescribeInstanceTypes API calls logged with the caller's IAM identity, source IP, and timestamp. These reconnaissance calls immediately precede RunInstances in real cryptojacking campaigns. Process telemetry: Sysmon Event ID 1 for aws.exe with describe-instances arguments.

Response Playbook

Triage

Identify the miner process: collect full command line, parent process, working directory, and file hash. Look for stratum+tcp:// URLs in the command line — they directly identify the mining pool and wallet address being used.
Check CPU and GPU utilization on the affected host via EDR telemetry or endpoint agent — miners typically drive sustained 80-100% CPU usage. Compare against the endpoint's historical baseline.
Decode the wallet address from the command line (e.g., '--user <wallet_address>') and search threat intelligence platforms (VirusTotal, MinerStat, CryptoScamDB) to attribute the wallet to a known threat actor campaign.
Identify the delivery vector: review process lineage from the miner back to the root parent. Common vectors include: cmd/PowerShell downloading from a URL, cron job or scheduled task executing a script, Docker container started with miner image, cloud instance bootstrap script, or compromised software supply chain.
Check for persistence mechanisms: scheduled tasks (schtasks /query), services (sc query), cron entries (/etc/cron*), startup folders, WMI subscriptions, and systemd unit files that reference the miner binary.
Scope the compromise: query for the same miner binary hash, pool URL, or wallet address across all endpoints. Lateral movement via SMB, WMI, or SSH is common in cryptojacking campaigns targeting enterprise environments.
Assess impact: check cloud billing dashboards if the host is a cloud instance — unexpected compute charges indicate hijacking at scale. Check if the instance type was modified or additional instances were provisioned.

Containment

Immediately kill the miner process using EDR response capabilities or kill -9 <pid> on Linux. Do not just terminate — verify the process does not restart from a persistence mechanism.
Isolate the affected endpoint from the network if lateral movement is suspected or if sensitive credentials may have been accessed by the initial access vector.
Delete or quarantine the miner binary and any related scripts. On Linux, check /tmp, /var/tmp, /dev/shm, and world-writable directories which are common staging areas for miner payloads.
Remove all identified persistence mechanisms: delete malicious scheduled tasks, revert modified cron jobs, disable or delete malicious services, remove WMI event subscriptions (Get-WMIObject -Namespace root/subscription -Class __EventFilter).
Rotate any credentials that were accessible on the compromised host, especially cloud API keys, service account tokens, SSH keys, and database passwords — miners often coexist with credential stealers.
If a cloud environment is affected: revoke compromised IAM credentials, audit and terminate any unauthorized instances or containers, review CloudTrail/Activity Logs for unauthorized API calls to RunInstances, CreateInstance, or container spin-up APIs.
Block the identified mining pool domains and IP ranges at the perimeter firewall, DNS resolver, and proxy. Block stratum protocol ports (3333, 4444, 5555, 7777, 9999, 14444, 45700) outbound for non-approved hosts.

Evidence Collection

Full process tree from EDR telemetry: parent process, grandparent process, all child processes, and associated command lines for the miner process and its ancestors.
Binary sample of the miner executable: calculate MD5/SHA256 hash, submit to VirusTotal, and preserve for forensic analysis. On Linux: cp /proc/<pid>/exe /evidence/miner_sample
Network connections made by the miner: destination IPs, ports, domains, bytes transferred. Sysmon Event ID 3 or EDR network telemetry. Extract mining pool URL and wallet address from stratum protocol traffic.
Persistence artifacts: scheduled task XML exports (schtasks /query /xml), cron entries (crontab -l; ls -la /etc/cron*), systemd unit files, service registry keys (HKLM\SYSTEM\CurrentControlSet\Services), WMI subscriptions.
Dropped files and staging artifacts: check /tmp, /var/tmp, /dev/shm (Linux) or %TEMP%, %APPDATA%, C:\Windows\Temp (Windows) for miner binaries, download scripts, and configuration files.
Authentication logs for the delivery vector: failed/successful SSH logins (Linux auth.log or /var/log/secure), Windows Security Event ID 4624/4625, VPN/RDP access logs around the time of initial infection.
Cloud audit logs if applicable: AWS CloudTrail, Azure Activity Logs, or GCP Audit Logs for RunInstances, DescribeInstances, CreateContainerInstance, or IAM key creation events that precede the mining activity.
Memory dump of the miner process if still running (procdump -ma <pid> on Windows, or gcore <pid> on Linux) to recover in-memory configuration, injected code, or C2 communication artifacts.

Escalation Criteria

! Miner binary spawned by a web server process (nginx, apache, tomcat, w3wp.exe) — indicates exploitation of a public-facing vulnerability such as Log4Shell, RCE, or SSRF.
! Miner deployed via a service account or privileged domain account — suggests credential compromise and potential for broader lateral movement across the environment.
! Same mining pool wallet address found on multiple endpoints — indicates organized campaign with automated lateral movement, potentially using EternalBlue, credential spraying, or worm-like propagation.
! Evidence of credential harvesting alongside mining (e.g., Mimikatz, LaZagne, or memory access to LSASS in the same process tree) — miner may be secondary payload alongside credential theft.
! Cloud resource provisioning events triggered by compromised keys — unauthorized RunInstances or container creation can generate significant financial impact within hours.
! Miner binary installed as a kernel module or rootkit component that hides the process from standard process listings — indicates sophisticated, persistent threat actor.
! Proxyjacking indicators present alongside cryptomining (e.g., peer2profit, traffmonetizer, iproyal processes) — combination of resource hijacking types suggests a coordinated campaign targeting multiple monetization channels.

Investigation Guide

Forensic Artifacts

> Linux: /proc/<pid>/exe — symlink to miner binary; /proc/<pid>/cmdline — null-delimited command line; /proc/<pid>/net/tcp — open network connections
> Linux: /tmp, /var/tmp, /dev/shm — common staging directories for miner payloads due to world-writable permissions and no-exec bypass techniques
> Linux: /etc/cron.d/, /etc/crontab, /var/spool/cron/crontabs/<user> — persistence via scheduled cron jobs
> Linux: /etc/systemd/system/ and ~/.config/systemd/user/ — persistence as systemd unit files; journalctl -u <service_name> for execution logs
> Windows: %TEMP%, %APPDATA%\Roaming, C:\Windows\Temp, C:\ProgramData — common miner drop locations
> Windows: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run — autorun persistence
> Windows: Scheduled tasks in C:\Windows\System32\Tasks\ or C:\Windows\SysWOW64\Tasks\ — XML files with miner execution details
> Windows Event Log: Security Event ID 7045 (new service installed), 4698/4702 (scheduled task created/modified) around the time of infection
> Network: PCAP or NetFlow data showing sustained outbound connections to mining pool IPs — stratum protocol is a recognizable JSON-RPC pattern even over encrypted channels
> Cloud: Billing anomaly reports, instance type change history, IAM key last-used timestamps, and CloudTrail/Activity Log entries for compute provisioning APIs

Tuning Guidance

Start by building a process name allowlist for any legitimate internal tools that use ports in the mining pool range (3333, 4444, etc.) — some database proxies and custom applications may use these ports. The stratum+tcp and mining-specific command-line patterns have very low false positive rates in enterprise environments and rarely require tuning. For the network-based detection, exclude your VPN client processes and internal proxy tools by adding their process names to a filter list. If your organization has authorized cryptocurrency research or security research involving mining tools, create a named exceptions group in your EDR and exclude those specific device groups from alerting. Consider enriching alerts with threat intelligence: extract wallet addresses from command lines and query CryptoScamDB or internal TI feeds to prioritize wallets associated with known campaigns. On Linux environments, pay special attention to processes running from /dev/shm — this is a memory-backed filesystem that leaves minimal on-disk artifacts and is a strong indicator of sophisticated cryptojacking. For cloud environments, set billing anomaly alerts with a low threshold ($50-100 unexpected daily spend) as an independent detection layer — compromised cloud credentials provisioning mining instances can generate thousands of dollars in charges within hours before process-level detections fire.

Hunting Queries

Hunt for sustained outbound connections to common mining pool ports from non-browser processes. High connection counts or multiple unique destination IPs on these ports from a single host/user are strong indicators of active mining. This query intentionally excludes browser processes and private IP ranges to focus on non-web mining traffic.

Hunting — KQL

kql

DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemotePort in (3333, 4444, 5555, 7777, 9999, 14444, 45700, 3256, 14433, 20536)
| where RemoteIPType == "Public"
| summarize ConnectionCount=count(), UniqueRemoteIPs=dcount(RemoteIP),
            TotalBytesSent=sum(SentBytes), TotalBytesReceived=sum(ReceivedBytes),
            Processes=make_set(InitiatingProcessFileName),
            Ports=make_set(RemotePort)
  by DeviceName, InitiatingProcessAccountName
| where ConnectionCount > 10 or UniqueRemoteIPs > 3
| sort by TotalBytesSent desc

Hunting — SPL

spl

index=* sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=3
DestinationPort IN ("3333","4444","5555","7777","9999","14444","45700","3256","14433","20536")
NOT (DestinationIp="10.*" OR DestinationIp="172.16.*" OR DestinationIp="192.168.*" OR DestinationIp="127.*")
| stats count as ConnectionCount, dc(DestinationIp) as UniqueIPs,
        values(DestinationPort) as Ports, values(Image) as Processes
  by host, User
| where ConnectionCount > 10 OR UniqueIPs > 3
| sort - ConnectionCount

Hunt for mining-specific command-line arguments and known pool names in process execution events. Extracts the wallet address from --user / --wallet arguments, which can be pivoted against threat intelligence databases to identify known threat actor campaigns or correlate multiple compromised hosts mining to the same wallet.

Hunting — KQL

kql

DeviceProcessEvents
| where Timestamp > ago(7d)
| where ProcessCommandLine has_any ("stratum+tcp", "stratum+ssl", "mining.subscribe", "--donate-level", "--coin xmr", "pool.minexmr", "xmrpool", "supportxmr", "nanopool", "f2pool", "ethermine", "nicehash")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
          InitiatingProcessFileName, SHA256, FolderPath
| extend WalletHint = extract(@"(-u|--user|--wallet)\s+([A-Za-z0-9]{30,})", 2, ProcessCommandLine)
| sort by Timestamp desc

Hunting — SPL

spl

index=* sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
(CommandLine="*stratum+tcp*" OR CommandLine="*stratum+ssl*" OR CommandLine="*mining.subscribe*"
 OR CommandLine="*--donate-level*" OR CommandLine="*pool.minexmr*" OR CommandLine="*xmrpool*"
 OR CommandLine="*nanopool*" OR CommandLine="*f2pool*" OR CommandLine="*ethermine*"
 OR CommandLine="*nicehash*")
| rex field=CommandLine "(-u|--user|--wallet)\s+(?<WalletAddress>[A-Za-z0-9]{30,})"
| table _time, host, User, Image, CommandLine, ParentImage, Hashes, CurrentDirectory, WalletAddress
| sort - _time

Hunt for miner binaries being written to common staging directories (temp directories, /dev/shm, ProgramData). Miners are frequently dropped to these locations because they are writable by low-privilege processes. File names mimicking system processes (kswapd0, kthreadd, svchost64) in temp directories are a strong indicator of evasion attempts.

Hunting — KQL

kql

DeviceFileEvents
| where Timestamp > ago(7d)
| where FolderPath has_any ("/tmp/", "/var/tmp/", "/dev/shm/", "C:\\Windows\\Temp\\", "C:\\ProgramData\\")
| where FileName has_any ("xmrig", "minerd", "miner", "kswapd", "kthreadd", "svchost64", "update")
   or SHA256 != ""
| join kind=leftouter (
    DeviceProcessEvents
    | where Timestamp > ago(7d)
    | where ProcessCommandLine has_any ("stratum", "--coin", "pool.", "--donate")
    | project DeviceName, MinerCommandLine=ProcessCommandLine, MinerSHA256=SHA256
  ) on DeviceName
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName,
          MinerCommandLine, MinerSHA256
| sort by Timestamp desc

Hunting — SPL

spl

index=* sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
(TargetFilename="*\\Temp\\*" OR TargetFilename="*\\tmp\\*" OR TargetFilename="*\\ProgramData\\*" OR TargetFilename="*/dev/shm/*")
(TargetFilename IN ("*xmrig*","*minerd*","*miner*","*kswapd0*","*svchost64*","*update64*"))
| table _time, host, User, TargetFilename, Image, ProcessGuid, Hashes
| sort - _time

Atomic Red Team Tests

Test 1 XMRig Miner Execution with Stratum Protocol Arguments

windows

Simulates the command-line pattern of XMRig, the most widely used open-source Monero miner deployed by threat actors. Downloads a benign placeholder (echo command) but constructs the exact command-line pattern used by real mining deployments, triggering process-creation-based detections. The pool and wallet values are test values that will generate a failed connection but produce the exact telemetry a real miner would generate.

Command

powershell

cmd.exe /c echo Simulating XMRig execution: xmrig.exe -o stratum+tcp://pool.minexmr.com:4444 -u 48edfHu7V9Z84YzzMa6fUVHotCmQFQDtVBF-u TestWorker --donate-level 1 --coin xmr

Expected Telemetry

Sysmon Event ID 1 (or Security Event ID 4688): Process Create for cmd.exe with CommandLine containing 'stratum+tcp', 'pool.minexmr.com', '--donate-level', and '--coin xmr'. The echo command generates no network connection but the command-line telemetry fully triggers the detection.

Expected Detection

KQL: ProcessCommandLine has_any (MinerCommandPatterns) fires on 'stratum+tcp', '--donate-level', '--coin xmr'. SPL: MinerCommandLine=1, RiskScore >= 75. Both KQL and SPL branches detect the stratum and pool arguments.

Test 2 Linux Miner Binary Dropped to /tmp and Executed

linux

Simulates the most common Linux cryptojacking delivery pattern: a binary with a miner-like name is written to /tmp (a world-writable, often no-exec-enforcement directory) and executed. Uses 'sleep' as a benign payload stand-in but generates the exact file creation and process execution telemetry of a real cryptominer deployment. This pattern is observed in TeamTNT, WatchDog, and Sysdig LabRat campaigns.

Command

bash

cp /usr/bin/sleep /tmp/xmrig && chmod +x /tmp/xmrig && /tmp/xmrig 30 &

Cleanup

bash

kill $(pgrep -f '/tmp/xmrig') 2>/dev/null; rm -f /tmp/xmrig

Expected Telemetry

Auditd or Sysmon for Linux: file creation event for /tmp/xmrig (execve or open syscall), process execution event showing Image=/tmp/xmrig. Linux audit log: SYSCALL records for execve with /tmp/xmrig. EDR: DeviceFileEvents for /tmp/xmrig creation, DeviceProcessEvents for /tmp/xmrig execution.

Expected Detection

KQL: DeviceFileEvents where FolderPath has '/tmp/' and FileName has 'xmrig'. SPL: EventCode=11 TargetFilename='*/tmp/xmrig*'. Process-based detections fire on the known miner name. The /tmp staging location also triggers the hunting query for miner binaries in temp directories.

Test 3 Outbound Connection to Mining Pool Port

windows

Attempts a TCP connection to a loopback address on port 3333 — the most commonly used stratum mining pool port. The connection will fail (no listener) but generates a Sysmon Event ID 3 network connection attempt that triggers port-based mining detection. In a real attack, the destination would be an external mining pool IP. This test safely validates the network-based detection logic.

Command

powershell

powershell.exe -Command "try { $client = New-Object System.Net.Sockets.TcpClient; $client.Connect('127.0.0.1', 3333); $client.Close() } catch { Write-Output 'Connection to port 3333 attempted (expected failure)' }"

Expected Telemetry

Sysmon Event ID 3: Network Connection with DestinationPort=3333, Image=powershell.exe, DestinationIp=127.0.0.1. The connection fails but the attempt is logged. In production, the query filters 127.0.0.1 — modify DestinationIp to an external test IP if available in your lab.

Expected Detection

SPL: EventCode=3, DestinationPort='3333', MiningPoolPort=1, RiskScore=70. KQL network branch: RemotePort in MiningPoolPorts. Note: the KQL query filters RemoteIPType=='Public', so localhost connections will not fire the main detection — use an external test IP in a controlled lab environment for full validation.

Test 4 Miner Persistence via Scheduled Task

windows

Creates a scheduled task that would re-launch a miner binary at logon — a common persistence technique used by Windows-targeted cryptojacking campaigns including those deploying XMRig and NiceHash miners. The task action points to a benign echo command but replicates the exact persistence pattern. Generates scheduled task creation telemetry (Security Event ID 4698) and a subsequent process execution on trigger.

Command

powershell

schtasks /create /tn "WindowsUpdateHelper" /tr "cmd.exe /c echo miner_placeholder --stratum stratum+tcp://pool.test:3333" /sc onlogon /ru SYSTEM /f

Cleanup

powershell

schtasks /delete /tn "WindowsUpdateHelper" /f

Expected Telemetry

Security Event ID 4698: A scheduled task was created, with TaskContent XML showing the action command line including 'stratum+tcp'. Sysmon Event ID 1 on next logon: cmd.exe executing with the stratum-like command line. Registry: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks entry created.

Expected Detection

KQL: DeviceProcessEvents where ProcessCommandLine has 'stratum+tcp' fires on scheduled task execution. Security Event 4698 shows the persistence creation. SPL: EventCode=4698 combined with CommandLine containing 'stratum' in the task XML. The combination of persistence + miner pattern is the highest-confidence indicator.

Test 5 Cloud Credential Abuse Simulation (AWS CLI Reconnaissance)

windows

Simulates an adversary who has obtained cloud credentials and begins enumerating compute resources as a precursor to provisioning unauthorized mining instances — a pattern seen in T1496.004 Cloud Service Hijacking campaigns. Uses AWS CLI to list running EC2 instances, which generates CloudTrail events. In a real attack, this would be followed by RunInstances calls to provision GPU instances for mining. Requires AWS CLI configured with test credentials.

Command

powershell

aws ec2 describe-instances --query "Reservations[*].Instances[*].[InstanceId,InstanceType,State.Name]" --output table && aws ec2 describe-instance-types --filters Name=vcpu-info.default-vcpus,Values=96 --query "InstanceTypes[*].InstanceType" --output json

Expected Telemetry

AWS CloudTrail: DescribeInstances and DescribeInstanceTypes API calls logged with the caller's IAM identity, source IP, and timestamp. These reconnaissance calls immediately precede RunInstances in real cryptojacking campaigns. Process telemetry: Sysmon Event ID 1 for aws.exe with describe-instances arguments.

Expected Detection

CloudTrail-based detection (requires SecurityEvent or CommonSecurityLog ingestion of CloudTrail): DescribeInstanceTypes queries filtering for high-vCPU instances (96+ cores) are uncommon in legitimate admin activity and suggest mining instance reconnaissance. Combined with subsequent RunInstances for GPU instance types (p3, p4, g4dn), this sequence constitutes T1496.004 Cloud Service Hijacking.

What is T1496 Resource Hijacking?

MITRE ATT&CK

Data Sources

Required Tables

False Positives

Data Sources

Required Sourcetypes

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Sigma rule & cross-platform mapping

Platform-specific guides for T1496

Testing Methodology

Response Playbook

Triage

Containment

Evidence Collection

Escalation Criteria

Investigation Guide

Forensic Artifacts

Tuning Guidance

Hunting Queries

Atomic Red Team Tests

Command

Expected Telemetry

Expected Detection

Command

Cleanup

Expected Telemetry

Expected Detection

Command

Expected Telemetry

Expected Detection

Command

Cleanup

Expected Telemetry

Expected Detection

Command

Expected Telemetry

Expected Detection

Related Detections

Tactic Hub

Sub-techniques (4)

Related Techniques

Same Tactic: Impact

Popular Detections

Get new detections in your inbox