Monero Crypto Coin Mining Pool Lookup

Detects suspicious DNS queries to Monero mining pools

Sigma rule (View on GitHub)

 1title: Monero Crypto Coin Mining Pool Lookup
 2id: b593fd50-7335-4682-a36c-4edcb68e4641
 3status: stable
 4description: Detects suspicious DNS queries to Monero mining pools
 5references:
 6    - https://www.nextron-systems.com/2021/10/24/monero-mining-pool-fqdns/
 7author: Florian Roth (Nextron Systems)
 8date: 2021/10/24
 9tags:
10    - attack.impact
11    - attack.t1496
12    - attack.t1567
13logsource:
14    category: dns
15detection:
16    selection:
17        query|contains:
18            - 'pool.minexmr.com'
19            - 'fr.minexmr.com'
20            - 'de.minexmr.com'
21            - 'sg.minexmr.com'
22            - 'ca.minexmr.com'
23            - 'us-west.minexmr.com'
24            - 'pool.supportxmr.com'
25            - 'mine.c3pool.com'
26            - 'xmr-eu1.nanopool.org'
27            - 'xmr-eu2.nanopool.org'
28            - 'xmr-us-east1.nanopool.org'
29            - 'xmr-us-west1.nanopool.org'
30            - 'xmr-asia1.nanopool.org'
31            - 'xmr-jp1.nanopool.org'
32            - 'xmr-au1.nanopool.org'
33            - 'xmr.2miners.com'
34            - 'xmr.hashcity.org'
35            - 'xmr.f2pool.com'
36            - 'xmrpool.eu'
37            - 'pool.hashvault.pro'
38    condition: selection
39falsepositives:
40    - Legitimate crypto coin mining
41level: high

References

Related rules

to-top