Is my host protected against XMRig crypto miner?

Compromised hosts may be used to mine cryptocurrency. This chain executes XMRig crypto miner and attempts to connect to a miner pool. It's important to monitor for the presence of cryptocurrency miners, as they may consume significant quantities of system resources.
This week, we're looking at a common cryptocurrency miner:
  • Is my host protected against XMRig crypto miner?

Is my host protected against XMRig crypto miner?

XMRig is a popular, open-source, cross-platform cryptocurrency miner. It's most used to mine Monero, but supports multiple mining algorithms including RandomX, KawPow, CryptoNight and GhostRider. XMRig has been used by numerous threat actors, including Iranian government-sponsored APT actors.
Mining cryptocurrency is a common resource hijacking technique. Although XMRig is a legitimate tool, adversaries have been known to use XMRig within a victim's network to mine cryptocurrency. In doing so, attackers can generate revenue in a potentially low-impact way as XMRig miners may be configured to consume a small percentage of system resources. If undetected for a prolonged period of time, this may result in significant financial loss for the victim.


Execute Operator’s Is my host protected against XMRig crypto miner? TTP on each host in your environment to test if you are vulnerable.

This chain is configured to stage the XMRig miner on the host and execute it. If the process is allowed to run on the host, XMRig miner will execute for 15 seconds and attempt to connect to a cryptocurrency mining pool. If the host is protected, the XMRig miner process should be blocked or killed.


To protect yourself from cryptocurrency mining, you should monitor for crypto miner processes on your hosts, block and kill any crypto miner processes, and monitor for outbound connections to cryptocurrency mining pools.

Check out the TTP Is my host protected against XMRig crypto miner? on the Prelude chains website.

Staying up to date

Thanks for reading our latest TTP Tuesday release! Please subscribe and reach out with any feedback. We love to hear from our community!
There are several ways to follow us and learn more about Prelude and our team members:

Get our products

Download Prelude Operator:
See the latest kill chain and TTP Releases:
See our open-source repositories:

Join our community


Read, watch, and listen

Listen to our Podcast:
Read our blog:
Watch our live streams:
Watch our pre-recorded content:

Follow our team


Read more

Execute this chain

Download Operator (1.7.1)
Learn about Operator


Is my host protected against XMRig crypto miner?