Detecting Illegitimate Crypto Miners on Linux Endpoints with Wazuh#

1
flowchart TB
2
    subgraph "Initial Access"
3
        A1[SSH Brute Force]
4
        A2[Vulnerability Exploit]
5
        A3[Stolen Credentials]
6
    end
7

8
    subgraph "Persistence"
9
        P1[Modify SSH Keys]
10
        P2[Create Cron Jobs]
11
        P3[Install Services]
12
        P4[Modify Startup]
13
    end
14

15
    subgraph "Execution"
16
        E1[Download Miner]
17
        E2[Execute in Memory]
18
        E3[Hide Process]
19
        E4[Mine Cryptocurrency]
20
    end
21

22
    subgraph "Propagation"
23
        PR1[Scan Network]
24
        PR2[Exploit Others]
25
        PR3[Spread Laterally]
26
    end
27

28
    A1 --> P1
29
    A2 --> P1
30
    A3 --> P1
31
    P1 --> P2
32
    P2 --> E1
33
    E1 --> E2
34
    E2 --> E3
35
    E3 --> E4
36
    E4 --> PR1
37
    PR1 --> PR2
38
    PR2 --> PR3
39

40
    style A1 fill:#ff6b6b
41
    style E4 fill:#ffd43b
42
    style PR3 fill:#ff6b6b

1
<group name="crypto_miner_advanced,">
2
  <!-- Known miner process names -->
3
  <rule id="100020" level="12">
4
    <if_sid>530</if_sid>
5
    <match>xmrig|minerd|cpuminer|xmr-stak|cgminer|bfgminer</match>
6
    <description>Known crypto miner process detected: $(full_log)</description>
7
    <mitre>
8
      <id>T1496</id>
9
    </mitre>
10
  </rule>
11

12
  <!-- Suspicious binary locations -->
13
  <rule id="100021" level="11">
14
    <if_sid>554</if_sid>
15
    <field name="file" type="pcre2">\/tmp\/|\/var\/tmp\/|\/dev\/shm\/</field>
16
    <regex>\.sh$|\.bin$|\.elf$</regex>
17
    <description>Suspicious executable in temporary directory: $(file)</description>
18
  </rule>
19

20
  <!-- Hidden process detection -->
21
  <rule id="100022" level="12">
22
    <if_sid>530</if_sid>
23
    <match>ps aux</match>
24
    <regex>\[\s*\]|\[crypto\]|\[kworker\]</regex>
25
    <description>Possible hidden crypto miner process</description>
26
  </rule>
27

28
  <!-- Mining pool connections -->
29
  <rule id="100023" level="13">
30
    <if_sid>530</if_sid>
31
    <match>netstat|ss</match>
32
    <regex>pool\.minexmr|nanopool|f2pool|antpool|stratum</regex>
33
    <description>Connection to known mining pool detected</description>
34
  </rule>
35

36
  <!-- Firewall modification -->
37
  <rule id="100024" level="11">
38
    <if_sid>2902</if_sid>
39
    <match>iptables -F|ufw disable</match>
40
    <description>Firewall rules cleared - possible miner activity</description>
41
  </rule>
42

43
  <!-- Multiple indicators correlation -->
44
  <rule id="100025" level="15" frequency="3" timeframe="300">
45
    <if_sid>100010,100012,100013</if_sid>
46
    <description>Multiple crypto miner indicators detected</description>
47
    <options>alert_by_email</options>
48
  </rule>
49
</group>

1
<!-- Monitor specific processes -->
2
<localfile>
3
  <log_format>full_command</log_format>
4
  <command>ps aux | grep -v grep | grep -E "xmrig|minerd|kworker|crypto" || echo "No miners found"</command>
5
  <alias>miner_process_check</alias>
6
  <frequency>300</frequency>
7
</localfile>
8

9
<!-- Check for suspicious network connections -->
10
<localfile>
11
  <log_format>full_command</log_format>
12
  <command>ss -tupn | grep -E ":3333|:4444|:5555|:7777|:8333|:9999" || echo "No suspicious connections"</command>
13
  <alias>miner_connection_check</alias>
14
  <frequency>300</frequency>
15
</localfile>

1
#!/bin/bash
2
# Block crypto miner activity
3

4
ACTION=$1
5
USER=$2
6
IP=$3
7
ALERTID=$4
8
RULEID=$5
9

10
if [ "$ACTION" = "add" ]; then
11
    # Kill suspicious processes
12
    pkill -f "xmrig|minerd|cpuminer|xmr-stak"
13

14
    # Block known mining pool IPs
15
    iptables -A OUTPUT -p tcp --dport 3333 -j DROP
16
    iptables -A OUTPUT -p tcp --dport 4444 -j DROP
17
    iptables -A OUTPUT -p tcp --dport 5555 -j DROP
18

19
    # Remove suspicious files
20
    find /tmp /var/tmp -name "*.sh" -mtime -1 -exec rm -f {} \;
21

22
    # Log action
23
    echo "$(date) - Blocked crypto miner activity" >> /var/log/crypto-miner-blocked.log
24
fi
25

26
if [ "$ACTION" = "delete" ]; then
27
    # Remove blocks (if needed)
28
    iptables -D OUTPUT -p tcp --dport 3333 -j DROP 2>/dev/null
29
    iptables -D OUTPUT -p tcp --dport 4444 -j DROP 2>/dev/null
30
    iptables -D OUTPUT -p tcp --dport 5555 -j DROP 2>/dev/null
31
fi

1
<command>
2
  <name>block-crypto-miner</name>
3
  <executable>block-crypto-miner.sh</executable>
4
  <expect>srcip</expect>
5
  <timeout_allowed>yes</timeout_allowed>
6
</command>
7

8
<active-response>
9
  <command>block-crypto-miner</command>
10
  <location>local</location>
11
  <rules_id>100013,100020,100023,100025</rules_id>
12
</active-response>

1
{
2
  "visualization": {
3
    "title": "Crypto Miner Detection Dashboard",
4
    "visState": {
5
      "type": "dashboard",
6
      "params": {
7
        "panels": [
8
          {
9
            "id": "ssh-failures",
10
            "type": "line",
11
            "title": "SSH Authentication Failures",
12
            "query": "rule.id:5551"
13
          },
14
          {
15
            "id": "cpu-usage",
16
            "type": "gauge",
17
            "title": "CPU Usage Alert Frequency",
18
            "query": "rule.id:100013"
19
          },
20
          {
21
            "id": "file-changes",
22
            "type": "data_table",
23
            "title": "Critical File Modifications",
24
            "query": "rule.groups:cryptominer"
25
          },
26
          {
27
            "id": "network-connections",
28
            "type": "pie",
29
            "title": "Mining Pool Connections",
30
            "query": "rule.id:100023"
31
          }
32
        ]
33
      }
34
    }
35
  }
36
}

1
Security Hardening:
2
  SSH Configuration:
3
    - Disable password authentication
4
    - Use key-based authentication only
5
    - Implement fail2ban
6
    - Change default SSH port
7

8
  System Hardening:
9
    - Regular security updates
10
    - Minimal software installation
11
    - Strict file permissions
12
    - SELinux/AppArmor enabled
13

14
  Network Security:
15
    - Outbound traffic filtering
16
    - Block unnecessary ports
17
    - Monitor DNS queries
18
    - Implement IDS/IPS

1
<!-- Environment-specific rules -->
2
<rule id="100030" level="8">
3
  <if_sid>100013</if_sid>
4
  <time>8:00 am - 6:00 pm</time>
5
  <weekday>monday,tuesday,wednesday,thursday,friday</weekday>
6
  <description>High CPU during business hours - investigate</description>
7
</rule>
8

9
<rule id="100031" level="14">
10
  <if_sid>100013</if_sid>
11
  <time>10:00 pm - 6:00 am</time>
12
  <description>High CPU during off-hours - likely crypto mining</description>
13
</rule>

1
#!/bin/bash
2
# Crypto miner incident response script
3

4
echo "=== Crypto Miner Incident Response ==="
5
echo "Started: $(date)"
6

7
# 1. Isolate the system
8
echo "Isolating system..."
9
# iptables -A INPUT -j DROP
10
# iptables -A OUTPUT -j DROP
11

12
# 2. Collect evidence
13
echo "Collecting evidence..."
14
mkdir -p /tmp/incident_response
15
ps aux > /tmp/incident_response/processes.txt
16
netstat -tulpn > /tmp/incident_response/connections.txt
17
crontab -l > /tmp/incident_response/crontab.txt
18
find /tmp /var/tmp -type f -mtime -7 > /tmp/incident_response/recent_files.txt
19

20
# 3. Kill malicious processes
21
echo "Terminating suspicious processes..."
22
pkill -f "xmrig|minerd|cpuminer|kworker"
23

24
# 4. Remove persistence
25
echo "Removing persistence mechanisms..."
26
# Check and clean crontabs
27
crontab -l | grep -v "wget\|curl\|/tmp/\|base64" | crontab -
28

29
# 5. Clean up
30
echo "Cleaning temporary files..."
31
find /tmp /var/tmp -name "*.sh" -o -name "config.json" | xargs rm -f
32

33
echo "Response completed: $(date)"

1
<!-- Detect process name spoofing -->
2
<rule id="100040" level="12">
3
  <if_sid>530</if_sid>
4
  <match>/usr/sbin/httpd</match>
5
  <regex>cpu.*[8-9]\d\.[0-9]%|cpu.*100\.[0-9]%</regex>
6
  <description>Suspicious high CPU usage by httpd - possible fake process</description>
7
</rule>
8

9
<!-- Detect mining through containers -->
10
<rule id="100041" level="11">
11
  <if_sid>87903</if_sid>
12
  <match>docker run</match>
13
  <regex>xmrig|monero|nicehash</regex>
14
  <description>Crypto mining container detected</description>
15
</rule>
16

17
<!-- Memory-based miner detection -->
18
<rule id="100042" level="12">
19
  <if_sid>530</if_sid>
20
  <match>ps aux</match>
21
  <regex>RSS.*[5-9]\d{5}|RSS.*[1-9]\d{6}</regex>
22
  <description>Process using excessive memory - possible miner</description>
23
</rule>

1
#!/usr/bin/env python3
2
# Analyze network traffic for mining patterns
3

4
import json
5
import re
6
from collections import defaultdict
7

8
def analyze_mining_traffic(log_file):
9
    """Analyze network logs for crypto mining patterns"""
10

11
    mining_pools = [
12
        'pool.minexmr.com',
13
        'xmr-us-east1.nanopool.org',
14
        'xmr.f2pool.com',
15
        'pool.supportxmr.com'
16
    ]
17

18
    suspicious_ports = [3333, 4444, 5555, 7777, 8333, 9999]
19
    connections = defaultdict(int)
20

21
    with open(log_file, 'r') as f:
22
        for line in f:
23
            try:
24
                log = json.loads(line)
25

26
                # Check for mining pool connections
27
                for pool in mining_pools:
28
                    if pool in log.get('dest_ip', ''):
29
                        connections[pool] += 1
30

31
                # Check for suspicious ports
32
                dest_port = log.get('dest_port', 0)
33
                if dest_port in suspicious_ports:
34
                    connections[f"Port_{dest_port}"] += 1
35

36
            except:
37
                continue
38

39
    return connections
40

41
# Generate alert if threshold exceeded
42
def check_thresholds(connections):
43
    for dest, count in connections.items():
44
        if count > 10:
45
            print(f"ALERT: Multiple connections to {dest} ({count} times)")

1
#!/usr/bin/env python3
2
# Forward crypto miner alerts to external SIEM
3

4
import requests
5
import json
6

7
def forward_to_siem(alert):
8
    """Forward high-priority crypto miner alerts"""
9

10
    if alert['rule']['id'] in ['100025', '100014', '100023']:
11
        siem_event = {
12
            'timestamp': alert['timestamp'],
13
            'severity': 'critical',
14
            'category': 'crypto_mining',
15
            'host': alert['agent']['name'],
16
            'details': {
17
                'rule': alert['rule']['description'],
18
                'indicators': extract_indicators(alert)
19
            }
20
        }
21

22
        requests.post(
23
            'https://siem.company.com/api/events',
24
            json=siem_event,
25
            headers={'Authorization': 'Bearer YOUR_TOKEN'}
26
        )
27

28
def extract_indicators(alert):
29
    """Extract IoCs from alert"""
30
    indicators = {
31
        'ips': [],
32
        'domains': [],
33
        'hashes': [],
34
        'processes': []
35
    }
36

37
    # Extract relevant indicators based on rule
38
    if 'full_log' in alert:
39
        # Extract IPs
40
        ips = re.findall(r'\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b',
41
                         alert['full_log'])
42
        indicators['ips'] = list(set(ips))
43

44
    return indicators

1
#!/bin/bash
2
# Update threat intelligence for crypto miners
3

4
THREAT_INTEL_DIR="/var/ossec/etc/lists"
5

6
# Download latest mining pool list
7
wget -O "$THREAT_INTEL_DIR/mining_pools.txt" \
8
  "https://raw.githubusercontent.com/your-repo/threat-intel/main/mining_pools.txt"
9

10
# Download latest miner hashes
11
wget -O "$THREAT_INTEL_DIR/miner_hashes.txt" \
12
  "https://raw.githubusercontent.com/your-repo/threat-intel/main/miner_hashes.txt"
13

14
# Convert to CDB format
15
cat "$THREAT_INTEL_DIR/mining_pools.txt" | awk '{print $1":"}' > \
16
  "$THREAT_INTEL_DIR/mining_pools"
17

18
cat "$THREAT_INTEL_DIR/miner_hashes.txt" | awk '{print $1":"}' > \
19
  "$THREAT_INTEL_DIR/miner_hashes"
20

21
# Restart Wazuh manager
22
systemctl restart wazuh-manager

1
Resource Usage Guidelines:
2
  FIM Monitoring:
3
    - Limit directories monitored
4
    - Use scan intervals appropriately
5
    - Exclude large/frequently changing directories
6

7
  Command Monitoring:
8
    - CPU check: Every 60 seconds
9
    - Process check: Every 300 seconds
10
    - Network check: Every 300 seconds
11

12
  Log Collection:
13
    - Rotate logs regularly
14
    - Compress archived logs
15
    - Set appropriate retention periods

1
<!-- Reduce noise from legitimate high CPU usage -->
2
<rule id="100050" level="0">
3
  <if_sid>100013</if_sid>
4
  <match>gcc|make|npm|docker|java</match>
5
  <description>Ignore high CPU from known processes</description>
6
</rule>
7

8
<!-- Time-based rule suppression -->
9
<rule id="100051" level="0">
10
  <if_sid>100010</if_sid>
11
  <time>8:00 am - 9:00 am</time>
12
  <description>Suppress SSH key alerts during maintenance window</description>
13
</rule>