Title:Possible Coin Miner CPU Priority Param Status:test Description:Detects command line parameter very often used with coin miners References: -https://xmrig.com/docs/miner/command-line-options Author: Florian Roth (Nextron Systems) Date: 2021-10-09 modified:2022-12-25 Tags:
-'attack.privilege-escalation'
-'attack.t1068'
Logsource:
product: linux
service: auditd
Detection: cmd1: a1|startswith:
'--cpu-priority' cmd2: a2|startswith:
'--cpu-priority' cmd3: a3|startswith:
'--cpu-priority' cmd4: a4|startswith:
'--cpu-priority' cmd5: a5|startswith:
'--cpu-priority' cmd6: a6|startswith:
'--cpu-priority' cmd7: a7|startswith:
'--cpu-priority' condition:1 of cmd* Falsepositives:
-Other tools that use a --cpu-priority flag Level:critical
