Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-K8s-CryptojackingResourceHijack.
Upgrade to ProDetect Kubernetes Cryptojacking — Cloud Compute Hijacking via Malicious Pod Deployment in Splunk
Cryptojacking crews (TeamTNT, Kinsing, WatchDog, Kiss-a-dog, and opportunistic campaigns like RBAC Buster/SCARLETEEL follow-on activity) systematically scan the internet for exposed Kubernetes control planes: anonymous-auth API servers, unauthenticated kubelet read-only ports (10255/10250), exposed dashboards (Weave Scope, Kubeflow), or leaked/over-privileged service account tokens harvested from a prior web-app compromise. Once inside, the attacker uses `kubectl create`/`apply` or a direct API call to deploy a DaemonSet or high-replica Deployment across every node in the cluster, pulling a miner image (XMRig, kdevtmpfsi, kinsing) from a public or attacker-controlled registry, frequently disguised behind a legitimate-looking image name or tag. Pods routinely request the maximum CPU the node scheduler will allow (or omit resource limits entirely), starving legitimate workloads and driving the victim's cloud compute bill up dramatically — a single hijacked node-pool can run into thousands of dollars per day on AWS EKS, Azure AKS, or GCP GKE. Many variants also set `hostPID`/`hostNetwork: true` or mount `/var/run/docker.sock`/hostPath `/` to escape the container and persist directly on the underlying node, then disable or kill competing miners and security agents (Falco, cloud-native EDR) before establishing outbound connections to a mining pool over Stratum protocol. Detection requires correlating Kubernetes audit logs (anomalous pod/DaemonSet creation, especially from a ServiceAccount or anonymous identity with no prior deployment history), container runtime/stdout logs (miner banner strings), and node-level network telemetry (outbound to known Stratum ports and mining-pool domains).
MITRE ATT&CK
- Tactic
- Impact
SPL Detection Query
index=k8s_audit sourcetype="kube:audit"
(verb="create" OR verb="update" OR verb="patch") (objectRef.resource="pods" OR objectRef.resource="daemonsets" OR objectRef.resource="deployments" OR objectRef.resource="replicasets")
(requestObject="*xmrig*" OR requestObject="*kdevtmpfsi*" OR requestObject="*kinsing*" OR requestObject="*monero*" OR requestObject="*minerd*" OR requestObject="*cryptonight*" OR requestObject="*nicehash*" OR requestObject="*c3pool*" OR requestObject="*supportxmr*" OR (requestObject="*hostNetwork*true*") OR (requestObject="*hostPID*true*"))
| eval Indicator="SuspiciousWorkloadCreate"
| append
[ search index=k8s_containers sourcetype="kube:container:log"
(log="*XMRig*" OR log="*stratum+tcp*" OR log="*cryptonight*" OR log="*randomx*" OR log="*donate-level*" OR log="*hashrate*")
| eval Indicator="MinerBannerInLogs" ]
| append
[ search index=network sourcetype="netflow" (dest_port=3333 OR dest_port=4444 OR dest_port=5555 OR dest_port=7777 OR dest_port=8080 OR dest_port=14444 OR dest_port=45700 OR dest_port=14433)
| bin _time span=10m
| stats count as ConnectionCount, values(dest_ip) as RemoteIPs by src_ip, _time
| where ConnectionCount>=3
| eval Indicator="MiningPoolConnection" ]
| sort - _timeSPL equivalent of the three-signal KQL detection. First sub-search matches Kubernetes audit events (kube-audit forwarded via the Splunk Connect for Kubernetes add-on or a generic HEC ingest) that create/update/patch a Pod, DaemonSet, Deployment, or ReplicaSet referencing a known miner image name or setting hostNetwork/hostPID to true. Second sub-search matches container stdout for XMRig/cryptonight/stratum banner strings. Third sub-search matches netflow records showing 3+ connections from a single host to a well-known Stratum mining port within a 10-minute bucket. Correlate matches across sub-searches on namespace/pod name/node within the same time window for high-confidence alerts.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Legitimate blockchain/crypto research workloads sandboxed in a dedicated namespace
- Security research or honeypot pods studying cryptojacking malware behavior
- Batch/ML training workloads that omit CPU limits by design
- CI/CD self-hosted runner DaemonSets requiring hostNetwork or hostPID for build isolation
- CNI/service-mesh DaemonSets (Cilium, Calico, Istio) that legitimately require hostNetwork:true
Other platforms for THREAT-K8s-CryptojackingResourceHijack
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulated Miner DaemonSet Deployment via kubectl (Lab Only)
Expected signal: Kubernetes audit log (kube-audit) records a 'create' event for objectRef.resource=daemonsets with objectRef.name=xmrig-test-457, requestObject containing hostNetwork:true, hostPID:true, and the image name 'xmrig-test-457' in metadata/labels.
- Test 2Simulated Miner Banner in Container Logs (Lab Only)
Expected signal: ContainerLogV2/kube:container:log records the literal banner string containing 'XMRig', 'stratum+tcp', 'cryptonight', and 'donate-level' for the pod miner-banner-test-457.
- Test 3Simulated Outbound Connection to Stratum Mining Port (Lab Only)
Expected signal: Node-level network telemetry (DeviceNetworkEvents / netflow) records 4 ConnectionSuccess events to RemotePort=3333 from the test host within a single 10-minute window.
References (7)
- https://attack.mitre.org/techniques/T1496/001/
- https://attack.mitre.org/techniques/T1610/
- https://attack.mitre.org/techniques/T1611/
- https://attack.mitre.org/tactics/TA0040/
- https://kubernetes.io/docs/tasks/debug/debug-cluster/audit/
- https://sysdig.com/blog/tor-teamtnt-mining-orchestration/
- https://www.crowdstrike.com/en-us/blog/kinsing-malware-attacks-targeting-container-environments/
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-K8s-CryptojackingResourceHijack — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month
Related Detections
Tactic Hub
Detection Variants (1)
Different telemetry and tradecraft for the same technique — pick the one that matches the data you collect.