Techniques
Sample rules
Possible Coin Miner CPU Priority Param
- source: sigma
- technicques:
- t1068
Description
Detects command line parameter very often used with coin miners
Detection logic
cmd1:
a1|startswith: --cpu-priority
cmd2:
a2|startswith: --cpu-priority
cmd3:
a3|startswith: --cpu-priority
cmd4:
a4|startswith: --cpu-priority
cmd5:
a5|startswith: --cpu-priority
cmd6:
a6|startswith: --cpu-priority
cmd7:
a7|startswith: --cpu-priority
condition: 1 of cmd*