attack.t1496

DNS Events Related To Mining Pools

Nov 24, 2025 · attack.execution attack.t1569.002 attack.impact attack.t1496 ·

Share on:

Identifies clients that may be performing DNS lookups associated with common currency mining pools.

Azure Container Registry Created or Deleted

Jun 4, 2025 · attack.impact attack.t1485 attack.t1496 attack.t1489 ·

Share on:

Detects when a Container Registry is created or deleted.

Azure Kubernetes Cluster Created or Deleted

Jun 4, 2025 · attack.impact attack.t1485 attack.t1496 attack.t1489 ·

Share on:

Detects when a Azure Kubernetes Cluster is created or deleted.

Azure Kubernetes Network Policy Change

Jun 4, 2025 · attack.impact attack.credential-access attack.t1485 attack.t1496 attack.t1489 ·

Share on:

Identifies when a Azure Kubernetes network policy is modified or deleted.

Azure Kubernetes RoleBinding/ClusterRoleBinding Modified and Deleted

Jun 4, 2025 · attack.impact attack.credential-access attack.t1485 attack.t1496 attack.t1489 ·

Share on:

Detects the creation or patching of potential malicious RoleBinding/ClusterRoleBinding.

Azure Kubernetes Secret or Config Object Access

Jun 4, 2025 · attack.impact attack.t1485 attack.t1496 attack.t1489 ·

Share on:

Identifies when a Kubernetes account access a sensitive objects such as configmaps or secrets.

Azure Kubernetes Sensitive Role Access

Jun 4, 2025 · attack.impact attack.t1485 attack.t1496 attack.t1489 ·

Share on:

Identifies when ClusterRoles/Roles are being modified or deleted.

Azure Kubernetes Service Account Modified or Deleted

Jun 4, 2025 · attack.impact attack.t1531 attack.t1485 attack.t1496 attack.t1489 ·

Share on:

Identifies when a service account is modified or deleted.

Monero Crypto Coin Mining Pool Lookup

Nov 4, 2024 · attack.impact attack.t1496 attack.exfiltration attack.t1567 ·

Share on:

Detects suspicious DNS queries to Monero mining pools

Linux Crypto Mining Indicators

Aug 12, 2024 · attack.impact attack.t1496 ·

Share on:

Detects command line parameters or strings often used by crypto miners

Linux Crypto Mining Pool Connections

Aug 12, 2024 · attack.impact attack.t1496 ·

Share on:

Detects process connections to a Monero crypto mining pool

Network Communication With Crypto Mining Pool

Aug 12, 2024 · attack.impact attack.t1496 ·

Share on:

Detects initiated network connections to crypto mining pools

Potential Crypto Mining Activity

Aug 12, 2024 · attack.impact attack.t1496 ·

Share on:

Detects command line parameters or strings often used by crypto miners