XMRIG Miner

Hunt Hypothesis

This detection identifies the execution of the XMRIG cryptocurrency miner, a common indicator of resource hijacking where adversaries deploy mining software to consume system CPU and network bandwidth for illicit profit. Proactively hunting for this behavior in Azure Sentinel is critical because low-severity miner activity often serves as an initial foothold or a distraction while attackers establish persistence mechanisms before launching more impactful attacks.

YARA Rule

rule XMRIG_Miner
{
	meta:
  ref = "https://gist.github.com/GelosSnake/c2d4d6ef6f93ccb7d3afb5b1e26c7b4e"
  strings:
    $a1 = "stratum+tcp"
    condition:
    $a1  
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the XMRIG Miner detection rule in an enterprise environment, along with suggested filters and exclusions:

• IT Asset Inventory Scans via PowerShell Scripts

  • Scenario: System administrators frequently deploy custom PowerShell scripts to inventory hardware specifications (CPU cores, RAM usage) across endpoints. These scripts often utilize xmrig as a lightweight benchmarking tool or include its libraries to generate performance reports without actually running the mining daemon in production mode.
  • Filter/Exclusion: Create an exclusion for processes spawned by powershell.exe where the command line arguments contain specific inventory keywords (e.g., -Inventory, -Report) and the parent process is a known management tool like Microsoft Endpoint Configuration Manager (MECM) or Ansible.

• Software Development & CI/CD Pipeline Execution

  • Scenario: In development environments, build agents (such as Jenkins, GitLab Runners, or Azure DevOps) often compile and test applications that integrate cryptocurrency libraries. During the “Build” or “Test” phases of a pipeline, these agents may instantiate xmrig to stress-test memory allocation or verify cryptographic library dependencies before deployment.
  • Filter/Exclusion: Exclude instances where the process path is located within standard CI/CD working directories (e.g., C:\Program Files\GitLab Runner\, D:\Jenkins\workspace\) and the user context is a service account named jenkins-agent or build-service.

• Scheduled Performance Baseline Jobs

  • Scenario: Enterprise IT operations often run nightly scheduled tasks to establish performance baselines for new server deployments. A specific scheduled job might launch xmrig in “headless” mode for 15 minutes to measure CPU thermal throttling and power consumption, which the detection rule