Is my host protected against XMRig crypto miner?

This week, we're looking at a common cryptocurrency miner:

• Is my host protected against XMRig crypto miner?

Is my host protected against XMRig crypto miner?

XMRig is a popular, open-source, cross-platform cryptocurrency miner. It's most used to mine Monero, but supports multiple mining algorithms including RandomX, KawPow, CryptoNight and GhostRider. XMRig has been used by numerous threat actors, including Iranian government-sponsored APT actors.
Mining cryptocurrency is a common resource hijacking technique. Although XMRig is a legitimate tool, adversaries have been known to use XMRig within a victim's network to mine cryptocurrency. In doing so, attackers can generate revenue in a potentially low-impact way as XMRig miners may be configured to consume a small percentage of system resources. If undetected for a prolonged period of time, this may result in significant financial loss for the victim.

Testing

Execute Operator’s Is my host protected against XMRig crypto miner? TTP on each host in your environment to test if you are vulnerable.

This chain is configured to stage the XMRig miner on the host and execute it. If the process is allowed to run on the host, XMRig miner will execute for 15 seconds and attempt to connect to a cryptocurrency mining pool. If the host is protected, the XMRig miner process should be blocked or killed.

Remediation

To protect yourself from cryptocurrency mining, you should monitor for crypto miner processes on your hosts, block and kill any crypto miner processes, and monitor for outbound connections to cryptocurrency mining pools.

Check out the TTP Is my host protected against XMRig crypto miner? on the Prelude chains website.

Staying up to date

Thanks for reading our latest TTP Tuesday release! Please subscribe and reach out with any feedback. We love to hear from our community!
There are several ways to follow us and learn more about Prelude and our team members:

Get our products

Download Prelude Operator: https://www.prelude.org/download/current
See the latest kill chain and TTP Releases: https://chains.prelude.org
See our open-source repositories: https://github.com/preludeorg

Join our community

Discord: https://discord.gg/gzUv4XNquu
Reddit: https://www.reddit.com/r/preludeorg/
Twitter: https://twitter.com/preludeorg

Read, watch, and listen

Listen to our Podcast: https://anchor.fm/preludeorg
Read our blog: https://feed.prelude.org
Watch our live streams: https://www.twitch.tv/preludeorg
Watch our pre-recorded content: https://www.youtube.com/c/preludeorg

Follow our team

David: https://twitter.com/privateducky
Alex: https://twitter.com/khyberspache
Octavia: https://twitter.com/VVX7
Waseem: https://twitter.com/gerbsec