Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-K8s-CryptojackingResourceHijack.
Upgrade to ProDetect Kubernetes Cryptojacking — Cloud Compute Hijacking via Malicious Pod Deployment in Google Chronicle
Cryptojacking crews (TeamTNT, Kinsing, WatchDog, Kiss-a-dog, and opportunistic campaigns like RBAC Buster/SCARLETEEL follow-on activity) systematically scan the internet for exposed Kubernetes control planes: anonymous-auth API servers, unauthenticated kubelet read-only ports (10255/10250), exposed dashboards (Weave Scope, Kubeflow), or leaked/over-privileged service account tokens harvested from a prior web-app compromise. Once inside, the attacker uses `kubectl create`/`apply` or a direct API call to deploy a DaemonSet or high-replica Deployment across every node in the cluster, pulling a miner image (XMRig, kdevtmpfsi, kinsing) from a public or attacker-controlled registry, frequently disguised behind a legitimate-looking image name or tag. Pods routinely request the maximum CPU the node scheduler will allow (or omit resource limits entirely), starving legitimate workloads and driving the victim's cloud compute bill up dramatically — a single hijacked node-pool can run into thousands of dollars per day on AWS EKS, Azure AKS, or GCP GKE. Many variants also set `hostPID`/`hostNetwork: true` or mount `/var/run/docker.sock`/hostPath `/` to escape the container and persist directly on the underlying node, then disable or kill competing miners and security agents (Falco, cloud-native EDR) before establishing outbound connections to a mining pool over Stratum protocol. Detection requires correlating Kubernetes audit logs (anomalous pod/DaemonSet creation, especially from a ServiceAccount or anonymous identity with no prior deployment history), container runtime/stdout logs (miner banner strings), and node-level network telemetry (outbound to known Stratum ports and mining-pool domains).
MITRE ATT&CK
- Tactic
- Impact
YARA-L Detection Query
rule k8s_cryptojacking_resource_hijack {
meta:
author = "df00tech Detection Engineering"
description = "Detects Kubernetes cryptojacking: miner-pattern workload creation, miner banner strings in container logs, or hostNetwork/hostPID escape attempts"
reference = "https://attack.mitre.org/techniques/T1496/001/"
severity = "HIGH"
priority = "HIGH"
mitre_attack_tactic = "Impact"
mitre_attack_technique = "T1496.001"
false_positives = "Legitimate crypto research, batch/ML workloads without CPU limits, CNI/service-mesh DaemonSets, CI/CD runners"
version = "1.0"
events:
$e.metadata.event_type = "GENERIC_EVENT"
(
re.regex($e.metadata.description, `(?i)(xmrig|kinsing|kdevtmpfsi|cryptonight|monero)`) or
re.regex($e.metadata.description, `(?i)(hostnetwork\s*[:=]\s*true|hostpid\s*[:=]\s*true)`) or
re.regex($e.metadata.description, `(?i)(stratum\+tcp|donate-level|randomx)`)
)
condition:
$e
}Chronicle YARA-L 2.0 rule matching GENERIC_EVENT UDM records populated from Kubernetes audit log and container stdout forwarding (Kubernetes audit typically arrives as unstructured/generic events without a dedicated Chronicle parser). Fires on miner image name patterns, hostNetwork/hostPID:true settings, or Stratum/donate-level/randomx banner strings captured in the event description field. Correlate $e.principal.namespace/$e.target.resource.name across matches within a 10-minute window in Chronicle's rule aggregation for the full multi-signal detection, and add a second rule against NETWORK_CONNECTION UDM events with target.port in the known Stratum port set.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate blockchain/crypto research workloads sandboxed in a dedicated namespace
- Batch/ML training workloads that omit CPU limits by design
- CNI/service-mesh DaemonSets requiring hostNetwork:true
- CI/CD self-hosted runner DaemonSets requiring hostPID
Other platforms for THREAT-K8s-CryptojackingResourceHijack
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulated Miner DaemonSet Deployment via kubectl (Lab Only)
Expected signal: Kubernetes audit log (kube-audit) records a 'create' event for objectRef.resource=daemonsets with objectRef.name=xmrig-test-457, requestObject containing hostNetwork:true, hostPID:true, and the image name 'xmrig-test-457' in metadata/labels.
- Test 2Simulated Miner Banner in Container Logs (Lab Only)
Expected signal: ContainerLogV2/kube:container:log records the literal banner string containing 'XMRig', 'stratum+tcp', 'cryptonight', and 'donate-level' for the pod miner-banner-test-457.
- Test 3Simulated Outbound Connection to Stratum Mining Port (Lab Only)
Expected signal: Node-level network telemetry (DeviceNetworkEvents / netflow) records 4 ConnectionSuccess events to RemotePort=3333 from the test host within a single 10-minute window.
References (7)
- https://attack.mitre.org/techniques/T1496/001/
- https://attack.mitre.org/techniques/T1610/
- https://attack.mitre.org/techniques/T1611/
- https://attack.mitre.org/tactics/TA0040/
- https://kubernetes.io/docs/tasks/debug/debug-cluster/audit/
- https://sysdig.com/blog/tor-teamtnt-mining-orchestration/
- https://www.crowdstrike.com/en-us/blog/kinsing-malware-attacks-targeting-container-environments/
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-K8s-CryptojackingResourceHijack — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month
Related Detections
Tactic Hub
Detection Variants (1)
Different telemetry and tradecraft for the same technique — pick the one that matches the data you collect.