cscli scenarios install sigmahq/proc_creation_win_susp_crypto_mining_monero1type: trigger2name: sigmahq/proc_creation_win_susp_crypto_mining_monero3description: |4 Detects command line parameters or strings often used by crypto miners5filter: |6 (evt.Meta.service == 'sysmon' && evt.Parsed.EventID == '1') && ((evt.Parsed.CommandLine contains ' --cpu-priority=' || evt.Parsed.CommandLine contains '--donate-level=0' || evt.Parsed.CommandLine contains ' -o pool.' || evt.Parsed.CommandLine contains ' --nicehash' || evt.Parsed.CommandLine contains ' --algo=rx/0 ' || evt.Parsed.CommandLine contains 'stratum+tcp://' || evt.Parsed.CommandLine contains 'stratum+udp://' || evt.Parsed.CommandLine contains 'LS1kb25hdGUtbGV2ZWw9' || evt.Parsed.CommandLine contains '0tZG9uYXRlLWxldmVsP' || evt.Parsed.CommandLine contains 'tLWRvbmF0ZS1sZXZlbD' || evt.Parsed.CommandLine contains 'c3RyYXR1bSt0Y3A6Ly' || evt.Parsed.CommandLine contains 'N0cmF0dW0rdGNwOi8v' || evt.Parsed.CommandLine contains 'zdHJhdHVtK3RjcDovL' || evt.Parsed.CommandLine contains 'c3RyYXR1bSt1ZHA6Ly' || evt.Parsed.CommandLine contains 'N0cmF0dW0rdWRwOi8v' || evt.Parsed.CommandLine contains 'zdHJhdHVtK3VkcDovL') && not (evt.Parsed.CommandLine contains ' pool.c ' || evt.Parsed.CommandLine contains ' pool.o ' || evt.Parsed.CommandLine contains 'gcc -'))7blackhole: 2m8#status: stable9labels:10 service: windows11 confidence: 212 spoofable: 013 classification:14 - attack.t14961516 label: "Potential Crypto Mining Activity"17 behavior : "windows:audit"18 remediation: false1920scope:21 type: ParentProcessId22 expression: evt.Parsed.ParentProcessId2324