Detect Resource Hijacking in Google Chronicle
Adversaries may leverage the resources of co-opted systems to complete resource-intensive tasks, which may impact system and/or hosted service availability. Resource hijacking includes cryptocurrency mining (cryptojacking), selling network bandwidth to proxy networks (proxyjacking), generating SMS traffic for profit, and abusing cloud-based messaging or compute services. Adversaries often deploy miners via initial access (phishing, exploitation), lateral movement, or compromised cloud credentials, and may use rootkits or process hollowing to hide mining activity.
MITRE ATT&CK
- Tactic
- Impact
- Technique
- T1496 Resource Hijacking
- Canonical reference
- https://attack.mitre.org/techniques/T1496/
YARA-L Detection Query
rule t1496_cryptominer_process_execution {
meta:
author = "Detection Engineering"
description = "Detects known cryptominer process names and mining command-line patterns. T1496 Resource Hijacking."
mitre_attack_tactic = "Impact"
mitre_attack_technique = "T1496"
severity = "HIGH"
confidence = "HIGH"
events:
$e.metadata.event_type = "PROCESS_LAUNCH"
(
re.regex($e.target.process.file.full_path,
`(?i)(xmrig|minerd|cpuminer|ethminer|nheqminer|t-rex|nbminer|phoenixminer|lolminer|gminer|bfgminer|cgminer|xmr-stak|poolminer|kawpowminer|teamredminer)(\.exe)?$`) or
re.regex($e.target.process.command_line,
`(?i)(stratum\+(tcp|ssl)|stratum2\+tcp|--donate-level|--coin[ =](xmr|monero)|-o pool\.|--url=.*pool|--wallet|mining\.(subscribe|authorize))`)
)
condition:
$e
}
rule t1496_cryptominer_lolbin_spawn {
meta:
author = "Detection Engineering"
description = "Detects cryptominer process spawned by scripting LOLBins, indicating script-based dropper activity. T1496 + T1059."
mitre_attack_tactic = "Impact"
mitre_attack_technique = "T1496"
severity = "CRITICAL"
confidence = "HIGH"
events:
$e.metadata.event_type = "PROCESS_LAUNCH"
re.regex($e.principal.process.file.full_path,
`(?i)(cmd\.exe|powershell\.exe|wscript\.exe|cscript\.exe|mshta\.exe|bash|sh)$`)
(
re.regex($e.target.process.file.full_path,
`(?i)(xmrig|minerd|cpuminer|ethminer|nheqminer|t-rex|nbminer|phoenixminer|lolminer|gminer|bfgminer|cgminer|xmr-stak|poolminer|kawpowminer|teamredminer)(\.exe)?$`) or
re.regex($e.target.process.command_line,
`(?i)(stratum\+(tcp|ssl)|--donate-level|--coin[ =](xmr|monero)|-o pool\.|--wallet|mining\.(subscribe|authorize))`)
)
condition:
$e
}
rule t1496_cryptominer_mining_pool_network {
meta:
author = "Detection Engineering"
description = "Detects outbound connections to known cryptocurrency mining pool ports, excluding browsers. T1496 Resource Hijacking."
mitre_attack_tactic = "Impact"
mitre_attack_technique = "T1496"
severity = "HIGH"
confidence = "MEDIUM"
events:
$net.metadata.event_type = "NETWORK_CONNECTION"
$net.target.port in (3333, 4444, 5555, 7777, 9999, 14444, 45700, 3256, 14433, 20536)
not net.ip_in_range_cidr($net.target.ip, "10.0.0.0/8")
not net.ip_in_range_cidr($net.target.ip, "172.16.0.0/12")
not net.ip_in_range_cidr($net.target.ip, "192.168.0.0/16")
not net.ip_in_range_cidr($net.target.ip, "127.0.0.0/8")
not re.regex($net.principal.process.file.full_path,
`(?i)(chrome\.exe|msedge\.exe|firefox\.exe|iexplore\.exe|outlook\.exe|teams\.exe)$`)
condition:
$net
}Three Chronicle YARA-L 2.0 rules covering T1496 Resource Hijacking. Rule 1 (HIGH) matches PROCESS_LAUNCH events for known miner executable names and stratum command-line patterns using UDM target.process fields. Rule 2 (CRITICAL) detects miners spawned by LOLBins using UDM principal.process for the parent and target.process for the child — the highest-fidelity signal. Rule 3 (MEDIUM confidence) detects NETWORK_CONNECTION events to mining pool ports with CIDR exclusions for RFC1918 and browser process filtering via principal.process. Deploy all three rules for full behavioral coverage across the kill chain.
Data Sources
Required Tables
False Positives & Tuning
- Authorized mining workloads in GCP or on-premises with valid business justification — add host principal values to a Chronicle reference list and filter with $e.principal.hostname in %approved_mining_hosts
- Cryptocurrency development toolchains using stratum protocol for local mining simulations during blockchain application development or testnet validation
- VPN or tunneling applications that use ports 3333 or 4444 for their control channel, triggering the network rule without process context to disambiguate — validate with principal.process and target.ip enrichment
Other platforms for T1496
Testing Methodology
Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1 XMRig Miner Execution with Stratum Protocol Arguments
Expected signal: Sysmon Event ID 1 (or Security Event ID 4688): Process Create for cmd.exe with CommandLine containing 'stratum+tcp', 'pool.minexmr.com', '--donate-level', and '--coin xmr'. The echo command generates no network connection but the command-line telemetry fully triggers the detection.
- Test 2 Linux Miner Binary Dropped to /tmp and Executed
Expected signal: Auditd or Sysmon for Linux: file creation event for /tmp/xmrig (execve or open syscall), process execution event showing Image=/tmp/xmrig. Linux audit log: SYSCALL records for execve with /tmp/xmrig. EDR: DeviceFileEvents for /tmp/xmrig creation, DeviceProcessEvents for /tmp/xmrig execution.
- Test 3 Outbound Connection to Mining Pool Port
Expected signal: Sysmon Event ID 3: Network Connection with DestinationPort=3333, Image=powershell.exe, DestinationIp=127.0.0.1. The connection fails but the attempt is logged. In production, the query filters 127.0.0.1 — modify DestinationIp to an external test IP if available in your lab.
- Test 4 Miner Persistence via Scheduled Task
Expected signal: Security Event ID 4698: A scheduled task was created, with TaskContent XML showing the action command line including 'stratum+tcp'. Sysmon Event ID 1 on next logon: cmd.exe executing with the stratum-like command line. Registry: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks entry created.
- Test 5 Cloud Credential Abuse Simulation (AWS CLI Reconnaissance)
Expected signal: AWS CloudTrail: DescribeInstances and DescribeInstanceTypes API calls logged with the caller's IAM identity, source IP, and timestamp. These reconnaissance calls immediately precede RunInstances in real cryptojacking campaigns. Process telemetry: Sysmon Event ID 1 for aws.exe with describe-instances arguments.
References (6)
- https://attack.mitre.org/techniques/T1496/
- https://sysdig.com/blog/labrat-cryptojacking-proxyjacking-campaign/
- https://unit42.paloaltonetworks.com/watchdog-cryptojacking/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1496/T1496.md
- https://www.microsoft.com/en-us/security/blog/2023/07/25/cryptojacking-understanding-and-defending-against-cloud-compute-resource-abuse/
- https://xmrig.com/docs/miner/command-line-options
Response Playbook
Triage
- Identify the miner process: collect full command line, parent process, working directory, and file hash. Look for stratum+tcp:// URLs in the command line — they directly identify the mining pool and wallet address being used.
- Check CPU and GPU utilization on the affected host via EDR telemetry or endpoint agent — miners typically drive sustained 80-100% CPU usage. Compare against the endpoint's historical baseline.
- Decode the wallet address from the command line (e.g., '--user <wallet_address>') and search threat intelligence platforms (VirusTotal, MinerStat, CryptoScamDB) to attribute the wallet to a known threat actor campaign.
- Identify the delivery vector: review process lineage from the miner back to the root parent. Common vectors include: cmd/PowerShell downloading from a URL, cron job or scheduled task executing a script, Docker container started with miner image, cloud instance bootstrap script, or compromised software supply chain.
- Check for persistence mechanisms: scheduled tasks (schtasks /query), services (sc query), cron entries (/etc/cron*), startup folders, WMI subscriptions, and systemd unit files that reference the miner binary.
- Scope the compromise: query for the same miner binary hash, pool URL, or wallet address across all endpoints. Lateral movement via SMB, WMI, or SSH is common in cryptojacking campaigns targeting enterprise environments.
- Assess impact: check cloud billing dashboards if the host is a cloud instance — unexpected compute charges indicate hijacking at scale. Check if the instance type was modified or additional instances were provisioned.
Containment
- Immediately kill the miner process using EDR response capabilities or kill -9 <pid> on Linux. Do not just terminate — verify the process does not restart from a persistence mechanism.
- Isolate the affected endpoint from the network if lateral movement is suspected or if sensitive credentials may have been accessed by the initial access vector.
- Delete or quarantine the miner binary and any related scripts. On Linux, check /tmp, /var/tmp, /dev/shm, and world-writable directories which are common staging areas for miner payloads.
- Remove all identified persistence mechanisms: delete malicious scheduled tasks, revert modified cron jobs, disable or delete malicious services, remove WMI event subscriptions (Get-WMIObject -Namespace root/subscription -Class __EventFilter).
- Rotate any credentials that were accessible on the compromised host, especially cloud API keys, service account tokens, SSH keys, and database passwords — miners often coexist with credential stealers.
- If a cloud environment is affected: revoke compromised IAM credentials, audit and terminate any unauthorized instances or containers, review CloudTrail/Activity Logs for unauthorized API calls to RunInstances, CreateInstance, or container spin-up APIs.
- Block the identified mining pool domains and IP ranges at the perimeter firewall, DNS resolver, and proxy. Block stratum protocol ports (3333, 4444, 5555, 7777, 9999, 14444, 45700) outbound for non-approved hosts.
Evidence Collection
- Full process tree from EDR telemetry: parent process, grandparent process, all child processes, and associated command lines for the miner process and its ancestors.
- Binary sample of the miner executable: calculate MD5/SHA256 hash, submit to VirusTotal, and preserve for forensic analysis. On Linux: cp /proc/<pid>/exe /evidence/miner_sample
- Network connections made by the miner: destination IPs, ports, domains, bytes transferred. Sysmon Event ID 3 or EDR network telemetry. Extract mining pool URL and wallet address from stratum protocol traffic.
- Persistence artifacts: scheduled task XML exports (schtasks /query /xml), cron entries (crontab -l; ls -la /etc/cron*), systemd unit files, service registry keys (HKLM\SYSTEM\CurrentControlSet\Services), WMI subscriptions.
- Dropped files and staging artifacts: check /tmp, /var/tmp, /dev/shm (Linux) or %TEMP%, %APPDATA%, C:\Windows\Temp (Windows) for miner binaries, download scripts, and configuration files.
- Authentication logs for the delivery vector: failed/successful SSH logins (Linux auth.log or /var/log/secure), Windows Security Event ID 4624/4625, VPN/RDP access logs around the time of initial infection.
- Cloud audit logs if applicable: AWS CloudTrail, Azure Activity Logs, or GCP Audit Logs for RunInstances, DescribeInstances, CreateContainerInstance, or IAM key creation events that precede the mining activity.
- Memory dump of the miner process if still running (procdump -ma <pid> on Windows, or gcore <pid> on Linux) to recover in-memory configuration, injected code, or C2 communication artifacts.
Escalation Criteria
- !Miner binary spawned by a web server process (nginx, apache, tomcat, w3wp.exe) — indicates exploitation of a public-facing vulnerability such as Log4Shell, RCE, or SSRF.
- !Miner deployed via a service account or privileged domain account — suggests credential compromise and potential for broader lateral movement across the environment.
- !Same mining pool wallet address found on multiple endpoints — indicates organized campaign with automated lateral movement, potentially using EternalBlue, credential spraying, or worm-like propagation.
- !Evidence of credential harvesting alongside mining (e.g., Mimikatz, LaZagne, or memory access to LSASS in the same process tree) — miner may be secondary payload alongside credential theft.
- !Cloud resource provisioning events triggered by compromised keys — unauthorized RunInstances or container creation can generate significant financial impact within hours.
- !Miner binary installed as a kernel module or rootkit component that hides the process from standard process listings — indicates sophisticated, persistent threat actor.
- !Proxyjacking indicators present alongside cryptomining (e.g., peer2profit, traffmonetizer, iproyal processes) — combination of resource hijacking types suggests a coordinated campaign targeting multiple monetization channels.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Linux: /proc/<pid>/exe — symlink to miner binary; /proc/<pid>/cmdline — null-delimited command line; /proc/<pid>/net/tcp — open network connections - >
Linux: /tmp, /var/tmp, /dev/shm — common staging directories for miner payloads due to world-writable permissions and no-exec bypass techniques - >
Linux: /etc/cron.d/, /etc/crontab, /var/spool/cron/crontabs/<user> — persistence via scheduled cron jobs - >
Linux: /etc/systemd/system/ and ~/.config/systemd/user/ — persistence as systemd unit files; journalctl -u <service_name> for execution logs - >
Windows: %TEMP%, %APPDATA%\Roaming, C:\Windows\Temp, C:\ProgramData — common miner drop locations - >
Windows: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run — autorun persistence - >
Windows: Scheduled tasks in C:\Windows\System32\Tasks\ or C:\Windows\SysWOW64\Tasks\ — XML files with miner execution details - >
Windows Event Log: Security Event ID 7045 (new service installed), 4698/4702 (scheduled task created/modified) around the time of infection - >
Network: PCAP or NetFlow data showing sustained outbound connections to mining pool IPs — stratum protocol is a recognizable JSON-RPC pattern even over encrypted channels - >
Cloud: Billing anomaly reports, instance type change history, IAM key last-used timestamps, and CloudTrail/Activity Log entries for compute provisioning APIs
Tuning Guidance
Start by building a process name allowlist for any legitimate internal tools that use ports in the mining pool range (3333, 4444, etc.) — some database proxies and custom applications may use these ports. The stratum+tcp and mining-specific command-line patterns have very low false positive rates in enterprise environments and rarely require tuning. For the network-based detection, exclude your VPN client processes and internal proxy tools by adding their process names to a filter list. If your organization has authorized cryptocurrency research or security research involving mining tools, create a named exceptions group in your EDR and exclude those specific device groups from alerting. Consider enriching alerts with threat intelligence: extract wallet addresses from command lines and query CryptoScamDB or internal TI feeds to prioritize wallets associated with known campaigns. On Linux environments, pay special attention to processes running from /dev/shm — this is a memory-backed filesystem that leaves minimal on-disk artifacts and is a strong indicator of sophisticated cryptojacking. For cloud environments, set billing anomaly alerts with a low threshold ($50-100 unexpected daily spend) as an independent detection layer — compromised cloud credentials provisioning mining instances can generate thousands of dollars in charges within hours before process-level detections fire.
Hunting Queries
Hunt for sustained outbound connections to common mining pool ports from non-browser processes. High connection counts or multiple unique destination IPs on these ports from a single host/user are strong indicators of active mining. This query intentionally excludes browser processes and private IP ranges to focus on non-web mining traffic.
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemotePort in (3333, 4444, 5555, 7777, 9999, 14444, 45700, 3256, 14433, 20536)
| where RemoteIPType == "Public"
| summarize ConnectionCount=count(), UniqueRemoteIPs=dcount(RemoteIP),
TotalBytesSent=sum(SentBytes), TotalBytesReceived=sum(ReceivedBytes),
Processes=make_set(InitiatingProcessFileName),
Ports=make_set(RemotePort)
by DeviceName, InitiatingProcessAccountName
| where ConnectionCount > 10 or UniqueRemoteIPs > 3
| sort by TotalBytesSent descindex=* sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=3
DestinationPort IN ("3333","4444","5555","7777","9999","14444","45700","3256","14433","20536")
NOT (DestinationIp="10.*" OR DestinationIp="172.16.*" OR DestinationIp="192.168.*" OR DestinationIp="127.*")
| stats count as ConnectionCount, dc(DestinationIp) as UniqueIPs,
values(DestinationPort) as Ports, values(Image) as Processes
by host, User
| where ConnectionCount > 10 OR UniqueIPs > 3
| sort - ConnectionCountHunt for mining-specific command-line arguments and known pool names in process execution events. Extracts the wallet address from --user / --wallet arguments, which can be pivoted against threat intelligence databases to identify known threat actor campaigns or correlate multiple compromised hosts mining to the same wallet.
DeviceProcessEvents
| where Timestamp > ago(7d)
| where ProcessCommandLine has_any ("stratum+tcp", "stratum+ssl", "mining.subscribe", "--donate-level", "--coin xmr", "pool.minexmr", "xmrpool", "supportxmr", "nanopool", "f2pool", "ethermine", "nicehash")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
InitiatingProcessFileName, SHA256, FolderPath
| extend WalletHint = extract(@"(-u|--user|--wallet)\s+([A-Za-z0-9]{30,})", 2, ProcessCommandLine)
| sort by Timestamp descindex=* sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
(CommandLine="*stratum+tcp*" OR CommandLine="*stratum+ssl*" OR CommandLine="*mining.subscribe*"
OR CommandLine="*--donate-level*" OR CommandLine="*pool.minexmr*" OR CommandLine="*xmrpool*"
OR CommandLine="*nanopool*" OR CommandLine="*f2pool*" OR CommandLine="*ethermine*"
OR CommandLine="*nicehash*")
| rex field=CommandLine "(-u|--user|--wallet)\s+(?<WalletAddress>[A-Za-z0-9]{30,})"
| table _time, host, User, Image, CommandLine, ParentImage, Hashes, CurrentDirectory, WalletAddress
| sort - _timeHunt for miner binaries being written to common staging directories (temp directories, /dev/shm, ProgramData). Miners are frequently dropped to these locations because they are writable by low-privilege processes. File names mimicking system processes (kswapd0, kthreadd, svchost64) in temp directories are a strong indicator of evasion attempts.
DeviceFileEvents
| where Timestamp > ago(7d)
| where FolderPath has_any ("/tmp/", "/var/tmp/", "/dev/shm/", "C:\\Windows\\Temp\\", "C:\\ProgramData\\")
| where FileName has_any ("xmrig", "minerd", "miner", "kswapd", "kthreadd", "svchost64", "update")
or SHA256 != ""
| join kind=leftouter (
DeviceProcessEvents
| where Timestamp > ago(7d)
| where ProcessCommandLine has_any ("stratum", "--coin", "pool.", "--donate")
| project DeviceName, MinerCommandLine=ProcessCommandLine, MinerSHA256=SHA256
) on DeviceName
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName,
MinerCommandLine, MinerSHA256
| sort by Timestamp descindex=* sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
(TargetFilename="*\\Temp\\*" OR TargetFilename="*\\tmp\\*" OR TargetFilename="*\\ProgramData\\*" OR TargetFilename="*/dev/shm/*")
(TargetFilename IN ("*xmrig*","*minerd*","*miner*","*kswapd0*","*svchost64*","*update64*"))
| table _time, host, User, TargetFilename, Image, ProcessGuid, Hashes
| sort - _timeAtomic Red Team Tests
Simulates the command-line pattern of XMRig, the most widely used open-source Monero miner deployed by threat actors. Downloads a benign placeholder (echo command) but constructs the exact command-line pattern used by real mining deployments, triggering process-creation-based detections. The pool and wallet values are test values that will generate a failed connection but produce the exact telemetry a real miner would generate.
Command
cmd.exe /c echo Simulating XMRig execution: xmrig.exe -o stratum+tcp://pool.minexmr.com:4444 -u 48edfHu7V9Z84YzzMa6fUVHotCmQFQDtVBF-u TestWorker --donate-level 1 --coin xmrExpected Telemetry
Sysmon Event ID 1 (or Security Event ID 4688): Process Create for cmd.exe with CommandLine containing 'stratum+tcp', 'pool.minexmr.com', '--donate-level', and '--coin xmr'. The echo command generates no network connection but the command-line telemetry fully triggers the detection.
Expected Detection
KQL: ProcessCommandLine has_any (MinerCommandPatterns) fires on 'stratum+tcp', '--donate-level', '--coin xmr'. SPL: MinerCommandLine=1, RiskScore >= 75. Both KQL and SPL branches detect the stratum and pool arguments.
Simulates the most common Linux cryptojacking delivery pattern: a binary with a miner-like name is written to /tmp (a world-writable, often no-exec-enforcement directory) and executed. Uses 'sleep' as a benign payload stand-in but generates the exact file creation and process execution telemetry of a real cryptominer deployment. This pattern is observed in TeamTNT, WatchDog, and Sysdig LabRat campaigns.
Command
cp /usr/bin/sleep /tmp/xmrig && chmod +x /tmp/xmrig && /tmp/xmrig 30 &Cleanup
kill $(pgrep -f '/tmp/xmrig') 2>/dev/null; rm -f /tmp/xmrigExpected Telemetry
Auditd or Sysmon for Linux: file creation event for /tmp/xmrig (execve or open syscall), process execution event showing Image=/tmp/xmrig. Linux audit log: SYSCALL records for execve with /tmp/xmrig. EDR: DeviceFileEvents for /tmp/xmrig creation, DeviceProcessEvents for /tmp/xmrig execution.
Expected Detection
KQL: DeviceFileEvents where FolderPath has '/tmp/' and FileName has 'xmrig'. SPL: EventCode=11 TargetFilename='*/tmp/xmrig*'. Process-based detections fire on the known miner name. The /tmp staging location also triggers the hunting query for miner binaries in temp directories.
Attempts a TCP connection to a loopback address on port 3333 — the most commonly used stratum mining pool port. The connection will fail (no listener) but generates a Sysmon Event ID 3 network connection attempt that triggers port-based mining detection. In a real attack, the destination would be an external mining pool IP. This test safely validates the network-based detection logic.
Command
powershell.exe -Command "try { $client = New-Object System.Net.Sockets.TcpClient; $client.Connect('127.0.0.1', 3333); $client.Close() } catch { Write-Output 'Connection to port 3333 attempted (expected failure)' }"Expected Telemetry
Sysmon Event ID 3: Network Connection with DestinationPort=3333, Image=powershell.exe, DestinationIp=127.0.0.1. The connection fails but the attempt is logged. In production, the query filters 127.0.0.1 — modify DestinationIp to an external test IP if available in your lab.
Expected Detection
SPL: EventCode=3, DestinationPort='3333', MiningPoolPort=1, RiskScore=70. KQL network branch: RemotePort in MiningPoolPorts. Note: the KQL query filters RemoteIPType=='Public', so localhost connections will not fire the main detection — use an external test IP in a controlled lab environment for full validation.
Creates a scheduled task that would re-launch a miner binary at logon — a common persistence technique used by Windows-targeted cryptojacking campaigns including those deploying XMRig and NiceHash miners. The task action points to a benign echo command but replicates the exact persistence pattern. Generates scheduled task creation telemetry (Security Event ID 4698) and a subsequent process execution on trigger.
Command
schtasks /create /tn "WindowsUpdateHelper" /tr "cmd.exe /c echo miner_placeholder --stratum stratum+tcp://pool.test:3333" /sc onlogon /ru SYSTEM /fCleanup
schtasks /delete /tn "WindowsUpdateHelper" /fExpected Telemetry
Security Event ID 4698: A scheduled task was created, with TaskContent XML showing the action command line including 'stratum+tcp'. Sysmon Event ID 1 on next logon: cmd.exe executing with the stratum-like command line. Registry: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks entry created.
Expected Detection
KQL: DeviceProcessEvents where ProcessCommandLine has 'stratum+tcp' fires on scheduled task execution. Security Event 4698 shows the persistence creation. SPL: EventCode=4698 combined with CommandLine containing 'stratum' in the task XML. The combination of persistence + miner pattern is the highest-confidence indicator.
Simulates an adversary who has obtained cloud credentials and begins enumerating compute resources as a precursor to provisioning unauthorized mining instances — a pattern seen in T1496.004 Cloud Service Hijacking campaigns. Uses AWS CLI to list running EC2 instances, which generates CloudTrail events. In a real attack, this would be followed by RunInstances calls to provision GPU instances for mining. Requires AWS CLI configured with test credentials.
Command
aws ec2 describe-instances --query "Reservations[*].Instances[*].[InstanceId,InstanceType,State.Name]" --output table && aws ec2 describe-instance-types --filters Name=vcpu-info.default-vcpus,Values=96 --query "InstanceTypes[*].InstanceType" --output jsonExpected Telemetry
AWS CloudTrail: DescribeInstances and DescribeInstanceTypes API calls logged with the caller's IAM identity, source IP, and timestamp. These reconnaissance calls immediately precede RunInstances in real cryptojacking campaigns. Process telemetry: Sysmon Event ID 1 for aws.exe with describe-instances arguments.
Expected Detection
CloudTrail-based detection (requires SecurityEvent or CommonSecurityLog ingestion of CloudTrail): DescribeInstanceTypes queries filtering for high-vCPU instances (96+ cores) are uncommon in legitimate admin activity and suggest mining instance reconnaissance. Combined with subsequent RunInstances for GPU instance types (p3, p4, g4dn), this sequence constitutes T1496.004 Cloud Service Hijacking.