Detectionhightest

Crypto Miner User Agent

Detects suspicious user agent strings used by crypto miners in proxy logs

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Florian Roth (Nextron Systems)Created Mon Oct 21Updated Sat Nov 27fa935401-513b-467b-81f4-f9e77aa0dd78web

Log Source

Proxy Log

CategoryProxy Log← raw: proxy

Detection Logic

detection:
    selection:
        c-useragent|startswith:
        # XMRig
            - 'XMRig '
        # CCMiner
            - 'ccminer'
    condition: selection

False Positives

Unknown

False positive likelihood has not been assessed. Additional context may be needed during triage.

References

MITRE ATT&CK

Tactics

TA0011 · Command and Control

Sub-techniques

T1071.001 · Web Protocols

Rule Metadata

Rule ID

fa935401-513b-467b-81f4-f9e77aa0dd78

Status

test

Level

high

Type

Detection

Created

Mon Oct 21

Modified

Sat Nov 27

Author

Florian Roth (Nextron Systems)

Path

rules/web/proxy_generic/proxy_ua_cryptominer.yml

Raw Tags

attack.command-and-controlattack.t1071.001

View on GitHub