Detect Resource Hijacking in Google Chronicle

rule t1496_cryptominer_process_execution {
  meta:
    author = "Detection Engineering"
    description = "Detects known cryptominer process names and mining command-line patterns. T1496 Resource Hijacking."
    mitre_attack_tactic = "Impact"
    mitre_attack_technique = "T1496"
    severity = "HIGH"
    confidence = "HIGH"

  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    (
      re.regex($e.target.process.file.full_path,
        `(?i)(xmrig|minerd|cpuminer|ethminer|nheqminer|t-rex|nbminer|phoenixminer|lolminer|gminer|bfgminer|cgminer|xmr-stak|poolminer|kawpowminer|teamredminer)(\.exe)?$`) or
      re.regex($e.target.process.command_line,
        `(?i)(stratum\+(tcp|ssl)|stratum2\+tcp|--donate-level|--coin[ =](xmr|monero)|-o pool\.|--url=.*pool|--wallet|mining\.(subscribe|authorize))`)
    )

  condition:
    $e
}

rule t1496_cryptominer_lolbin_spawn {
  meta:
    author = "Detection Engineering"
    description = "Detects cryptominer process spawned by scripting LOLBins, indicating script-based dropper activity. T1496 + T1059."
    mitre_attack_tactic = "Impact"
    mitre_attack_technique = "T1496"
    severity = "CRITICAL"
    confidence = "HIGH"

  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    re.regex($e.principal.process.file.full_path,
      `(?i)(cmd\.exe|powershell\.exe|wscript\.exe|cscript\.exe|mshta\.exe|bash|sh)$`)
    (
      re.regex($e.target.process.file.full_path,
        `(?i)(xmrig|minerd|cpuminer|ethminer|nheqminer|t-rex|nbminer|phoenixminer|lolminer|gminer|bfgminer|cgminer|xmr-stak|poolminer|kawpowminer|teamredminer)(\.exe)?$`) or
      re.regex($e.target.process.command_line,
        `(?i)(stratum\+(tcp|ssl)|--donate-level|--coin[ =](xmr|monero)|-o pool\.|--wallet|mining\.(subscribe|authorize))`)
    )

  condition:
    $e
}

rule t1496_cryptominer_mining_pool_network {
  meta:
    author = "Detection Engineering"
    description = "Detects outbound connections to known cryptocurrency mining pool ports, excluding browsers. T1496 Resource Hijacking."
    mitre_attack_tactic = "Impact"
    mitre_attack_technique = "T1496"
    severity = "HIGH"
    confidence = "MEDIUM"

  events:
    $net.metadata.event_type = "NETWORK_CONNECTION"
    $net.target.port in (3333, 4444, 5555, 7777, 9999, 14444, 45700, 3256, 14433, 20536)
    not net.ip_in_range_cidr($net.target.ip, "10.0.0.0/8")
    not net.ip_in_range_cidr($net.target.ip, "172.16.0.0/12")
    not net.ip_in_range_cidr($net.target.ip, "192.168.0.0/16")
    not net.ip_in_range_cidr($net.target.ip, "127.0.0.0/8")
    not re.regex($net.principal.process.file.full_path,
      `(?i)(chrome\.exe|msedge\.exe|firefox\.exe|iexplore\.exe|outlook\.exe|teams\.exe)$`)

  condition:
    $net
}