Detect mining pool and miner arguments in process command lines

Siemphony@siemphonyhighT1496.001unverifiedPlaybook · Destructive impact

Matches process creation whose command line carries a cryptocurrency mining configuration: a `stratum://` pool URL, the donation, rig-identity and NiceHash switches that miner families expose, or a RandomX/Monero algorithm selection. MITRE names `Image` as a mutable element for this analytic — campaigns rename and masquerade the binary — so the logic sits entirely on `CommandLine`, which the pool configuration cannot be stripped from and still mine. Sustained CPU consumption and the persistent pool connection are the analytic's real discriminators; neither a resource threshold nor a duration is expressible in Sigma, so this catches the launch rather than the sustained load. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0540, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

1title: Detect mining pool and miner arguments in process command lines2id: d61c99a5-3dd7-40da-abb6-f73c320da66b3status: experimental4description: |5  Matches process creation whose command line carries a cryptocurrency mining6  configuration: a `stratum://` pool URL, the donation, rig-identity and NiceHash7  switches that miner families expose, or a RandomX/Monero algorithm selection.8  MITRE names `Image` as a mutable element for this analytic — campaigns rename and9  masquerade the binary — so the logic sits entirely on `CommandLine`, which the10  pool configuration cannot be stripped from and still mine. Sustained CPU11  consumption and the persistent pool connection are the analytic's real12  discriminators; neither a resource threshold nor a duration is expressible in13  Sigma, so this catches the launch rather than the sustained load.14  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0540, not hand-written and not tested by its author. Any lab result is on this rule's own page.15references:16  - https://attack.mitre.org/techniques/T1496/00117  - https://attack.mitre.org/detectionstrategies/DET054018author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)19date: 2026-08-1620tags:21  - attack.impact22  - attack.t1496.00123logsource:24  category: process_creation25  product: windows26detection:27  selection:28    CommandLine|contains:29      - 'stratum+tcp://'30      - 'stratum+ssl://'31      - 'stratum1+tcp://'32      - 'stratum2+tcp://'33      - '--donate-level'34      - '--nicehash'35      - '--rig-id'36      - '--algo=rx/0'37      - '--algo=randomx'38      - '--coin=monero'39      - 'xmrig'40      - 'minerd'41  condition: selection42falsepositives:43  - "Hosts where mining is intentional — a research, blockchain-development or benchmarking machine, or a workstation whose owner mines out of hours. The command line is identical to the malicious case; only the asset's purpose separates them, so scope this rule by host group rather than by term."44  - "Security tooling handling the sample rather than running it. Detonation sandboxes, EDR scanners and an analyst pasting a miner config into a console all put these strings on a legitimate parent's command line. MITRE lists `ParentProcessName` as the mutable element for exactly this — filter on the known-good launcher."45  - "Wrapper and orchestration scripts that pass a miner configuration through without being the miner, such as a container entrypoint or a scheduled task whose argument string is logged verbatim. The same launch then re-alerts on every scheduled run."46level: high

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where (ProcessCommandLine contains "stratum+tcp://" or ProcessCommandLine contains "stratum+ssl://" or ProcessCommandLine contains "stratum1+tcp://" or ProcessCommandLine contains "stratum2+tcp://" or ProcessCommandLine contains "--donate-level" or ProcessCommandLine contains "--nicehash" or ProcessCommandLine contains "--rig-id" or ProcessCommandLine contains "--algo=rx/0" or ProcessCommandLine contains "--algo=randomx" or ProcessCommandLine contains "--coin=monero" or ProcessCommandLine contains "xmrig" or ProcessCommandLine contains "minerd")

Splunk · SPL

Run this as a search.

index=* (CommandLine="*stratum+tcp://*" OR CommandLine="*stratum+ssl://*" OR CommandLine="*stratum1+tcp://*" OR CommandLine="*stratum2+tcp://*" OR CommandLine="*--donate-level*" OR CommandLine="*--nicehash*" OR CommandLine="*--rig-id*" OR CommandLine="*--algo=rx/0*" OR CommandLine="*--algo=randomx*" OR CommandLine="*--coin=monero*" OR CommandLine="*xmrig*" OR CommandLine="*minerd*")

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (TO_LOWER(process.command_line) LIKE "*stratum+tcp://*" OR TO_LOWER(process.command_line) LIKE "*stratum+ssl://*" OR TO_LOWER(process.command_line) LIKE "*stratum1+tcp://*" OR TO_LOWER(process.command_line) LIKE "*stratum2+tcp://*" OR TO_LOWER(process.command_line) LIKE "*--donate-level*" OR TO_LOWER(process.command_line) LIKE "*--nicehash*" OR TO_LOWER(process.command_line) LIKE "*--rig-id*" OR TO_LOWER(process.command_line) LIKE "*--algo=rx/0*" OR TO_LOWER(process.command_line) LIKE "*--algo=randomx*" OR TO_LOWER(process.command_line) LIKE "*--coin=monero*" OR TO_LOWER(process.command_line) LIKE "*xmrig*" OR TO_LOWER(process.command_line) LIKE "*minerd*")

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="12">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="CommandLine" type="pcre2">(?i)(stratum\+tcp://|stratum\+ssl://|stratum1\+tcp://|stratum2\+tcp://|--donate-level|--nicehash|--rig-id|--algo=rx/0|--algo=randomx|--coin=monero|xmrig|minerd)</field>    <description>Detect mining pool and miner arguments in process command lines</description>    <mitre>      <id>T1496.001</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: high
Category: impact_destruction
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: d61c99a5-3dd7-40da-abb6-f73c320da66b

ATT&CKT1496.001

T1496.001Compute Hijacking

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Evidence

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1496.001, evaluated against their process_creation events.

Using it

Tuning & false positivesexperimental · 3 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

MITRE's `ParentProcessName` knob: filter on the known-good launcher — this
MITRE's `Image` knob: use it in reverse. Anchor xmrig and minerd as
Drop the = from the algorithm and coin terms, and consider --url= and -o ,
MITRE's `DestinationIP` knob is the pairing this rule wants: a companion on
Scope by host group, not by removing terms, for the intentional-mining case.

Declared by the author

Hosts where mining is intentional — a research, blockchain-development or benchmarking machine, or a workstation whose owner mines out of hours. The command line is identical to the malicious case; only the asset's purpose separates them, so scope this rule by host group rather than by term.
Security tooling handling the sample rather than running it. Detonation sandboxes, EDR scanners and an analyst pasting a miner config into a console all put these strings on a legitimate parent's command line. MITRE lists ParentProcessName as the mutable element for exactly this — filter on the known-good launcher.
Wrapper and orchestration scripts that pass a miner configuration through without being the miner, such as a container entrypoint or a scheduled task whose argument string is logged verbatim. The same launch then re-alerts on every scheduled run.

Lessonimpact destruction

impact destructionAI draft — unreviewed

01 · What this rule detects

A process starting on Windows whose command line carries a cryptocurrency mining configuration: a stratum pool URL, one of the operational switches the xmrig family exposes, an algorithm or coin selection, or a family name. MITRE's AN1489 describes "sustained execution of resource-intensive processes ... frequently establish persistent external connections and attempt to evade detection using masqueraded or renamed binaries." Three observables there: sustained CPU, a persistent pool connection, and a renamed binary. Sigma can express none of the first two — there is no resource threshold and no duration — so this rule catches the launch, and the launch only.

02 · Telemetry you need

process_creation on Windows with the command line populated. On Sysmon that
One field: CommandLine. Nothing else.
Coverage note: the brief offers AN1490 (process_creation / linux) and

03 · How the logic works

One selection, a twelve-term OR on a single field:

Why there is no second selection. Unlike a parent-child rule, each term here is meant to be self-sufficient: stratum+tcp:// appears in essentially nothing but a miner configuration. That is why a bare OR is defensible. It also means the rule is exactly as good as its weakest term — and two of them are weak. Why the logic avoids `Image`. MITRE names Image as a mutable element for this analytic precisely because campaigns rename the binary. Putting the logic on CommandLine instead is a sound inference from that knob. But the description over-claims, and the reviewer caught it. rule.yml says the pool configuration "cannot be stripped from [the command line] and still mine." That is untrue, and it is the justification the whole rule rests on. xmrig reads config.json from its working directory when launched with no arguments, and -c <file> points it anywhere; cpuminer and xmr-stak have equivalents. Real droppers routinely ship a config file or bake the pool into a repacked binary. A renamed binary plus a config file mines at full rate and produces zero matching strings. Learn the invariant correctly: command-line pool arguments catch the careless launch — a real and common case, but not the technique. Three terms are pinned to the wrong form. --donate-level and --rig-id stop before the separator, so they match both --rig-id X and --rig-id=X. --nicehash takes no value. But --algo=rx/0, --algo=randomx and --coin=monero include the =, and xmrig accepts --algo rx/0, -a rx/0 and --coin monero identically. The ordinary space-separated invocation misses all three.

04 · Common false positives

Hosts where mining is intentional — research, blockchain development,
The defender's own tooling. xmrig and minerd are unanchored substrings
Detonation sandboxes and EDR scanners handling a sample rather than running it,

05 · Detection maturity

tier_1: .** UNVERIFIED — derived from DET0540 and never executed against a log line. level: high is a judgement about term specificity, not a measured rate; the Wazuh render emits level 12 off the back of it. To reach
tier_2: turn the command-line prerequisite on and confirm it, sweep history for the two bare family names before enabling them, fix the three =-pinned terms, and add the pool-port network companion so the config-file case is not a silent gap.
tier_3: restores the analytic's real discriminator — sustained CPU over a window correlated with a persistent pool connection — which is aggregation, not Sigma.

Share this rule

/u/siemphony/d61c99a5-3dd7-40da-abb6-f73c320da66b

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Detect mining pool and miner arguments in process command lines

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it