Threat: Cryptomining

AWS Potential Cryptomining via ECS Task Definition Deployment

Sep 19, 2026 · Domain: Cloud Data Source: AWS Data Source: AWS CloudTrail Data Source: Amazon Web Services Use Case: Threat Detection Tactic: Impact Resources: Investigation Guide Noise: Unknown Performance: Fast Profile: Recommended Threat: Cryptomining Rule Type: ES|QL Platform: AWS ·

Share on:

Identifies a principal that, within a short window, both registers an Amazon ECS task definition using a public / non-ECR container image at a high CPU allocation (8 or 16 vCPU) AND launches ECS workloads (RunTask, StartTask, or CreateService). Registering a public miner image at maximum compute and then launching it is the ECS/Fargate cryptocurrency-mining deployment pattern seen after credential compromise. Requiring both the mining-signature registration and a launch by the same principal confirms an actual deployment rather than a standalone (possibly benign) task-definition registration, which sharply reduces false positives from high-compute workloads that are merely registered.

Detection Alert on a Process Exhibiting CPU Spike

Sep 19, 2026 · Use Case: Threat Detection Rule Type: Higher-Order Rule Resources: Investigation Guide Domain: Endpoint Tactic: Impact Noise: Low Performance: Normal Profile: Recommended Threat: Cryptomining Rule Type: ES|QL ·

Share on:

This rule correlates security alerts with processes exhibiting unusually high CPU utilization on the same host and process ID within a short time window. This behavior may indicate malicious activity such as malware execution, cryptomining, exploit payload execution, or abuse of system resources following initial compromise.

Multiple Alerts on a Host Exhibiting CPU Spike

Sep 19, 2026 · Use Case: Threat Detection Rule Type: Higher-Order Rule Resources: Investigation Guide Domain: Endpoint Tactic: Impact Noise: Medium Performance: Normal Profile: Recommended Threat: Cryptomining Rule Type: ES|QL ·

Share on:

This rule correlates multiple security alerts from a host exhibiting unusually high CPU utilization within a short time window. This behavior may indicate malicious activity such as malware execution, cryptomining, exploit payload execution, or abuse of system resources following initial compromise.

Newly Observed Process Exhibiting High CPU Usage

Sep 19, 2026 · Use Case: Threat Detection Use Case: Observavility Resources: Investigation Guide Domain: Endpoint Tactic: Impact Noise: Low Performance: Normal Profile: Recommended Threat: Cryptomining Rule Type: ES|QL ·

Share on:

This rule alerts on processes exhibiting high CPU usage and that are observed for the first time in the previous 5 days. A previously unseen process consuming sustained CPU resources may indicate suspicious activity such as cryptomining, exploit payload execution, or other forms of resource abuse following host compromise. In some cases, this may also surface legitimate but unexpected software causing performance degradation.

Potential Redis CONFIG SET Cron Directory Persistence (RedisRaider)

Sep 19, 2026 · Domain: Network Use Case: Threat Detection Tactic: Persistence Tactic: Impact Data Source: Network Packet Capture Resources: Investigation Guide Noise: Unknown Performance: Fast Profile: Recommended Threat: Cryptomining Rule Type: Event Correlation (EQL) ·

Share on:

This rule detects attempts to abuse Redis CONFIG SET commands to redirect the database save directory to a cron directory on Linux hosts. Attackers issue CONFIG SET dir to a cron path such as /etc/cron.d or /var/spool/cron, set a filename via CONFIG SET dbfilename, write a cron payload via SET, and then call BGSAVE to flush it to disk, establishing persistence for execution of an XMRig cryptominer.