Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-K8s-CryptojackingResourceHijack.
Upgrade to ProDetect Kubernetes Cryptojacking — Cloud Compute Hijacking via Malicious Pod Deployment in IBM QRadar
Cryptojacking crews (TeamTNT, Kinsing, WatchDog, Kiss-a-dog, and opportunistic campaigns like RBAC Buster/SCARLETEEL follow-on activity) systematically scan the internet for exposed Kubernetes control planes: anonymous-auth API servers, unauthenticated kubelet read-only ports (10255/10250), exposed dashboards (Weave Scope, Kubeflow), or leaked/over-privileged service account tokens harvested from a prior web-app compromise. Once inside, the attacker uses `kubectl create`/`apply` or a direct API call to deploy a DaemonSet or high-replica Deployment across every node in the cluster, pulling a miner image (XMRig, kdevtmpfsi, kinsing) from a public or attacker-controlled registry, frequently disguised behind a legitimate-looking image name or tag. Pods routinely request the maximum CPU the node scheduler will allow (or omit resource limits entirely), starving legitimate workloads and driving the victim's cloud compute bill up dramatically — a single hijacked node-pool can run into thousands of dollars per day on AWS EKS, Azure AKS, or GCP GKE. Many variants also set `hostPID`/`hostNetwork: true` or mount `/var/run/docker.sock`/hostPath `/` to escape the container and persist directly on the underlying node, then disable or kill competing miners and security agents (Falco, cloud-native EDR) before establishing outbound connections to a mining pool over Stratum protocol. Detection requires correlating Kubernetes audit logs (anomalous pod/DaemonSet creation, especially from a ServiceAccount or anonymous identity with no prior deployment history), container runtime/stdout logs (miner banner strings), and node-level network telemetry (outbound to known Stratum ports and mining-pool domains).
MITRE ATT&CK
- Tactic
- Impact
QRadar Detection Query
SELECT
DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') AS EventTime,
UTF8(payload) AS RawMessage,
CASE
WHEN LOWER(UTF8(payload)) LIKE '%xmrig%' OR LOWER(UTF8(payload)) LIKE '%kinsing%' OR LOWER(UTF8(payload)) LIKE '%kdevtmpfsi%' OR LOWER(UTF8(payload)) LIKE '%cryptonight%'
OR (LOWER(UTF8(payload)) LIKE '%hostnetwork%true%') OR (LOWER(UTF8(payload)) LIKE '%hostpid%true%') THEN 'SuspiciousWorkloadCreate'
WHEN LOWER(UTF8(payload)) LIKE '%stratum+tcp%' OR LOWER(UTF8(payload)) LIKE '%donate-level%' OR LOWER(UTF8(payload)) LIKE '%randomx%' THEN 'MinerBannerInLogs'
ELSE 'Other'
END AS Indicator
FROM events
WHERE
LOWER(UTF8(payload)) LIKE '%xmrig%'
OR LOWER(UTF8(payload)) LIKE '%kinsing%'
OR LOWER(UTF8(payload)) LIKE '%kdevtmpfsi%'
OR LOWER(UTF8(payload)) LIKE '%cryptonight%'
OR LOWER(UTF8(payload)) LIKE '%stratum+tcp%'
OR LOWER(UTF8(payload)) LIKE '%donate-level%'
OR (LOWER(UTF8(payload)) LIKE '%hostnetwork%true%')
OR (LOWER(UTF8(payload)) LIKE '%hostpid%true%')
ORDER BY devicetime DESC
LAST 24 HOURSQRadar AQL query over Kubernetes audit and container log events forwarded to a generic log source (e.g. via a Kubernetes audit webhook to a syslog/HEC collector feeding QRadar, since there is no dedicated QRadar Kubernetes DSM). Categorizes matches into SuspiciousWorkloadCreate (miner image name or hostNetwork/hostPID:true in the audit payload) and MinerBannerInLogs (Stratum/donate-level/randomx strings from container stdout). Pair with a separate flow-based AQL search (`SELECT sourceip, destinationport FROM flows WHERE destinationport IN (3333,4444,5555,7777,8080,14444,45700,14433)`) for the network-connection signal, and correlate via a QRadar rule requiring 2+ indicator types from the same source within 10 minutes.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate blockchain/crypto research workloads sandboxed in a dedicated namespace
- Batch/ML training workloads that omit CPU limits by design
- CNI/service-mesh DaemonSets requiring hostNetwork:true
- CI/CD self-hosted runner DaemonSets requiring hostPID
Other platforms for THREAT-K8s-CryptojackingResourceHijack
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulated Miner DaemonSet Deployment via kubectl (Lab Only)
Expected signal: Kubernetes audit log (kube-audit) records a 'create' event for objectRef.resource=daemonsets with objectRef.name=xmrig-test-457, requestObject containing hostNetwork:true, hostPID:true, and the image name 'xmrig-test-457' in metadata/labels.
- Test 2Simulated Miner Banner in Container Logs (Lab Only)
Expected signal: ContainerLogV2/kube:container:log records the literal banner string containing 'XMRig', 'stratum+tcp', 'cryptonight', and 'donate-level' for the pod miner-banner-test-457.
- Test 3Simulated Outbound Connection to Stratum Mining Port (Lab Only)
Expected signal: Node-level network telemetry (DeviceNetworkEvents / netflow) records 4 ConnectionSuccess events to RemotePort=3333 from the test host within a single 10-minute window.
References (7)
- https://attack.mitre.org/techniques/T1496/001/
- https://attack.mitre.org/techniques/T1610/
- https://attack.mitre.org/techniques/T1611/
- https://attack.mitre.org/tactics/TA0040/
- https://kubernetes.io/docs/tasks/debug/debug-cluster/audit/
- https://sysdig.com/blog/tor-teamtnt-mining-orchestration/
- https://www.crowdstrike.com/en-us/blog/kinsing-malware-attacks-targeting-container-environments/
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-K8s-CryptojackingResourceHijack — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month
Related Detections
Tactic Hub
Detection Variants (1)
Different telemetry and tradecraft for the same technique — pick the one that matches the data you collect.