Rules Contributing to DNS Query to Monero Crypto Coin Mining Pool Domains

The following rules are used to identify DNS queries to Monero crypto coin mining pool domains. Any one or more of these will trigger the DNS Query to Monero Crypto Coin Mining Pool Domains Alert. Details for each rule can be viewed by clicking the More Details link in the description.

Title

Description

DNS Query to Monero Crypto Coin Mining Pool Domains

DNS query to Monero crypto coin mining pool domains.

Rule ID

dns_4

Query

{'selection_domain': {'DnsQuestionName|endswith': ['pool.minexmr.com', 'fr.minexmr.com', 'de.minexmr.com', 'sg.minexmr.com', 'ca.minexmr.com', 'us-west.minexmr.com', 'pool.supportxmr.com', 'mine.c3pool.com', 'xmr-eu1.nanopool.org', 'xmr-eu2.nanopool.org', 'xmr-us-east1.nanopool.org', 'xmr-us-west1.nanopool.org', 'xmr-asia1.nanopool.org', 'xmr-jp1.nanopool.org', 'xmr-au1.nanopool.org', 'xmr.2miners.com', 'xmr.hashcity.org', 'xmr.f2pool.com', 'xmrpool.eu', 'pool.hashvault.pro']}, 'condition': 'selection_domain'}

Log Source

Stellar Cyber Network Events configured.

Rule Source

SigmaHQ,b593fd50-7335-4682-a36c-4edcb68e4641

Author: Florian Roth (Nextron Systems)

Tactics, Techniques, and Procedures

TA0040, T1496, TA0010, T1567

References

Severity

50

Suppression Logic Based On

  • srcip
  • dns.question.name
  • stellar.rule_id

Additional Information

Maturity Creation Date Risk Level False Positives
stable 2021/10/24 high

  • Legitimate access to Monero mining pools. Rarely happens unless legitimate programs contain crypto mining functions.