Kubernetes Cryptojacking — Cloud Compute Hijacking via Malicious Pod Deployment

// THREAT-K8s-CryptojackingResourceHijack (T1496.001 Resource Hijacking: Compute Hijacking)
// Requires AKS diagnostic settings sending kube-audit to AKSAudit, and Defender for Containers/MDE node sensors for DeviceNetworkEvents
let MinerImagePatterns = dynamic(["xmrig", "kdevtmpfsi", "kinsing", "monero", "minerd", "cryptonight", "nicehash", "c3pool", "supportxmr"]);
let MiningPorts = dynamic([3333, 4444, 5555, 7777, 8080, 14444, 45700, 14433]);
let Lookback = 1h;
// Signal 1: Kubernetes audit log shows a Pod/DaemonSet/Deployment created with a miner-matching image, no resource limits, or hostPID/hostNetwork set
let SuspiciousWorkloadCreate = AKSAudit
| where TimeGenerated > ago(Lookback)
| where Verb in ("create", "update", "patch") and ObjectRef.resource in ("pods", "daemonsets", "deployments", "replicasets")
| extend RequestBody = tostring(RequestObject)
| where RequestBody has_any (MinerImagePatterns)
    or (RequestBody has "hostNetwork" and RequestBody has "true")
    or (RequestBody has "hostPID" and RequestBody has "true")
| project TimeGenerated, User = tostring(User.username), Namespace = tostring(ObjectRef.namespace), ObjectName = tostring(ObjectRef.name), Resource = tostring(ObjectRef.resource), RequestBody, Indicator = "SuspiciousWorkloadCreate";
// Signal 2: container stdout/stderr contains miner banner strings (XMRig prints its version/pool banner on startup)
let MinerBannerInLogs = ContainerLogV2
| where TimeGenerated > ago(Lookback)
| where LogMessage has_any ("XMRig", "stratum+tcp", "cryptonight", "randomx", "donate-level", "hashrate")
| project TimeGenerated, Namespace = PodNamespace, ObjectName = PodName, Resource = "pod", RequestBody = LogMessage, Indicator = "MinerBannerInLogs";
// Signal 3: node-level outbound network connection to a known Stratum mining port
let MiningPoolConnections = DeviceNetworkEvents
| where TimeGenerated > ago(Lookback)
| where ActionType == "ConnectionSuccess"
| where RemotePort in (MiningPorts)
| summarize ConnectionCount = count(), RemoteIPs = make_set(RemoteIP, 10) by DeviceName, InitiatingProcessFileName, bin(TimeGenerated, 10m)
| where ConnectionCount >= 3
| project TimeGenerated, Namespace = "(node-level)", ObjectName = DeviceName, Resource = InitiatingProcessFileName, RequestBody = strcat("RemoteIPs=", tostring(RemoteIPs)), Indicator = "MiningPoolConnection";
union SuspiciousWorkloadCreate, MinerBannerInLogs, MiningPoolConnections
| sort by TimeGenerated desc

index=k8s_audit sourcetype="kube:audit"
(verb="create" OR verb="update" OR verb="patch") (objectRef.resource="pods" OR objectRef.resource="daemonsets" OR objectRef.resource="deployments" OR objectRef.resource="replicasets")
(requestObject="*xmrig*" OR requestObject="*kdevtmpfsi*" OR requestObject="*kinsing*" OR requestObject="*monero*" OR requestObject="*minerd*" OR requestObject="*cryptonight*" OR requestObject="*nicehash*" OR requestObject="*c3pool*" OR requestObject="*supportxmr*" OR (requestObject="*hostNetwork*true*") OR (requestObject="*hostPID*true*"))
| eval Indicator="SuspiciousWorkloadCreate"
| append
  [ search index=k8s_containers sourcetype="kube:container:log"
    (log="*XMRig*" OR log="*stratum+tcp*" OR log="*cryptonight*" OR log="*randomx*" OR log="*donate-level*" OR log="*hashrate*")
    | eval Indicator="MinerBannerInLogs" ]
| append
  [ search index=network sourcetype="netflow" (dest_port=3333 OR dest_port=4444 OR dest_port=5555 OR dest_port=7777 OR dest_port=8080 OR dest_port=14444 OR dest_port=45700 OR dest_port=14433)
    | bin _time span=10m
    | stats count as ConnectionCount, values(dest_ip) as RemoteIPs by src_ip, _time
    | where ConnectionCount>=3
    | eval Indicator="MiningPoolConnection" ]
| sort - _time

any where event.dataset == "kubernetes.audit_logs" and (
  (kubernetes.audit.verb in ("create", "update", "patch") and kubernetes.audit.objectRef.resource in ("pods", "daemonsets", "deployments", "replicasets")) and (
    kubernetes.audit.requestObject : ("*xmrig*", "*kdevtmpfsi*", "*kinsing*", "*monero*", "*cryptonight*") or
    (kubernetes.audit.requestObject : "*hostNetwork*true*") or
    (kubernetes.audit.requestObject : "*hostPID*true*")
  )
)

SELECT
  DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') AS EventTime,
  UTF8(payload) AS RawMessage,
  CASE
    WHEN LOWER(UTF8(payload)) LIKE '%xmrig%' OR LOWER(UTF8(payload)) LIKE '%kinsing%' OR LOWER(UTF8(payload)) LIKE '%kdevtmpfsi%' OR LOWER(UTF8(payload)) LIKE '%cryptonight%'
      OR (LOWER(UTF8(payload)) LIKE '%hostnetwork%true%') OR (LOWER(UTF8(payload)) LIKE '%hostpid%true%') THEN 'SuspiciousWorkloadCreate'
    WHEN LOWER(UTF8(payload)) LIKE '%stratum+tcp%' OR LOWER(UTF8(payload)) LIKE '%donate-level%' OR LOWER(UTF8(payload)) LIKE '%randomx%' THEN 'MinerBannerInLogs'
    ELSE 'Other'
  END AS Indicator
FROM events
WHERE
  LOWER(UTF8(payload)) LIKE '%xmrig%'
  OR LOWER(UTF8(payload)) LIKE '%kinsing%'
  OR LOWER(UTF8(payload)) LIKE '%kdevtmpfsi%'
  OR LOWER(UTF8(payload)) LIKE '%cryptonight%'
  OR LOWER(UTF8(payload)) LIKE '%stratum+tcp%'
  OR LOWER(UTF8(payload)) LIKE '%donate-level%'
  OR (LOWER(UTF8(payload)) LIKE '%hostnetwork%true%')
  OR (LOWER(UTF8(payload)) LIKE '%hostpid%true%')
ORDER BY devicetime DESC
LAST 24 HOURS

_sourceCategory=*kubernetes*audit* or _sourceCategory=*k8s*audit*
| where _raw matches "(?i).*(xmrig|kinsing|kdevtmpfsi|cryptonight|monero).*"
    or (_raw matches "(?i).*hostnetwork.*true.*")
    or (_raw matches "(?i).*hostpid.*true.*")
| eval Indicator = "SuspiciousWorkloadCreate"
| union (
    _sourceCategory=*kubernetes*container* or _sourceCategory=*k8s*container*
    | where _raw matches "(?i).*(stratum\\+tcp|donate-level|randomx|hashrate).*"
    | eval Indicator = "MinerBannerInLogs"
  )
| union (
    _sourceCategory=*netflow* or _sourceCategory=*firewall*
    | where dst_port in (3333, 4444, 5555, 7777, 8080, 14444, 45700, 14433)
    | timeslice 10m
    | stats count as ConnectionCount by src_ip, _timeslice
    | where ConnectionCount >= 3
    | eval Indicator = "MiningPoolConnection"
  )
| sort by _messagetime desc

rule k8s_cryptojacking_resource_hijack {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects Kubernetes cryptojacking: miner-pattern workload creation, miner banner strings in container logs, or hostNetwork/hostPID escape attempts"
    reference = "https://attack.mitre.org/techniques/T1496/001/"
    severity = "HIGH"
    priority = "HIGH"
    mitre_attack_tactic = "Impact"
    mitre_attack_technique = "T1496.001"
    false_positives = "Legitimate crypto research, batch/ML workloads without CPU limits, CNI/service-mesh DaemonSets, CI/CD runners"
    version = "1.0"

  events:
    $e.metadata.event_type = "GENERIC_EVENT"
    (
      re.regex($e.metadata.description, `(?i)(xmrig|kinsing|kdevtmpfsi|cryptonight|monero)`) or
      re.regex($e.metadata.description, `(?i)(hostnetwork\s*[:=]\s*true|hostpid\s*[:=]\s*true)`) or
      re.regex($e.metadata.description, `(?i)(stratum\+tcp|donate-level|randomx)`)
    )

  condition:
    $e
}

// Falcon sensor does not natively parse Kubernetes audit events; assumes kube-audit and container stdout ingested into LogScale via a Fluentd/Fluent Bit collector into #repo=k8s_audit
#repo=k8s_audit
("xmrig" OR "kinsing" OR "kdevtmpfsi" OR "cryptonight" OR "monero" OR ("hostNetwork" AND "true") OR ("hostPID" AND "true") OR "stratum+tcp" OR "donate-level" OR "randomx")
| Indicator := case {
    /(?i)(xmrig|kinsing|kdevtmpfsi|cryptonight|monero)/ => "SuspiciousWorkloadCreate" ;
    /(?i)(hostnetwork.*true|hostpid.*true)/ => "SuspiciousWorkloadCreate" ;
    /(?i)(stratum\+tcp|donate-level|randomx)/ => "MinerBannerInLogs" ;
    * => "Other"
  }
| groupBy([#repo, Indicator], function=[count(as=EventCount), collect(@rawstring, limit=20)], limit=max)
| sort(EventCount, order=desc)