A Possible crypto miner was detected on a host
Synopsis
Field
Value
Activation Period
14 Days
Training Period
30 Days
Test Period
N/A (single event)
Deduplication Period
1 Day
Required Data
Requires one of the following data sources: Palo Alto Networks Firewall traffic Logs OR XDR Agent
ATT&CK Tactic
Impact (TA0040)
ATT&CK Technique
Resource Hijacking (T1496)
Severity
Medium
Description
The host produced traffic consistent with the crypto mining.
Attacker's Goals
Abuse resources to mine crypto coins.
Investigative actions
Check the host for crypto mining client software.
Look for differences in the resource consumption from this host.
Examine the client's network traffic for suspicious domains affiliated with mining or mining pools.
Was this helpful?