Techniques
Sample rules
XMRIG Driver Loaded
- source: splunk
- technicques:
- T1543.003
- T1543
Description
The following analytic detects the installation of the XMRIG coinminer driver on a system. It identifies the loading of the WinRing0x64.sys driver, commonly associated with XMRIG, by analyzing Sysmon EventCode 6 logs for specific signatures and image loads. This activity is significant because XMRIG is an open-source CPU miner frequently exploited by adversaries to mine cryptocurrency illicitly. If confirmed malicious, this activity could lead to unauthorized resource consumption, degraded system performance, and potential financial loss due to unauthorized cryptocurrency mining.
Detection logic
`sysmon` EventCode=6 Signature="Noriyuki MIYAZAKI" OR ImageLoaded= "*\\WinRing0x64.sys"
| stats min(_time) as firstTime max(_time) as lastTime count by dest ImageLoaded Hashes IMPHASH Signature Signed
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `xmrig_driver_loaded_filter`