<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: detecting-cloud-cryptojacking
description: >-
  Detect unauthorized cryptocurrency mining in AWS, Azure, and GCP environments
  by monitoring compute anomalies, network indicators, and billing spikes that
  signal cryptojacking activity across cloud workloads.
domain: cybersecurity
subdomain: cloud-security
tags:
  - aws
  - azure
  - gcp
  - cryptojacking
  - threat-detection
  - guardduty
  - billing-anomaly
  - compute-abuse
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1496"]
---

# Detecting Cloud Cryptojacking

## Overview

Cryptojacking in cloud environments exploits compromised credentials, misconfigured
workloads, or vulnerable applications to run unauthorized mining software. Attackers
target high-CPU/GPU instance types and often spin up new instances across multiple
regions to maximize hash rate while evading detection. This skill covers detection
across AWS, Azure, and GCP using native security services, billing analysis, and
network traffic indicators.

Mode: `[MODE: BLUE]` — Threat detection and monitoring.

## Prerequisites

| Requirement | Details |
|---|---|
| AWS CLI v2, Azure CLI, and/or `gcloud` CLI configured | Required |
| IAM permissions for CloudWatch, GuardDuty, Cost Explorer, Billing | Required |
| Azure | Defender for Cloud, Azure Monitor, Cost Management access |
| GCP | Security Command Center, Cloud Monitoring, Billing access |
| Python 3.10+ with `boto3`, `azure-identity`, `google-cloud-monitoring` | Required |

## Key Concepts

### Indicators of Cryptojacking

Common signals that distinguish mining from legitimate workloads:

1. **Compute anomalies** — sustained 90-100% CPU on instances not expected to run compute-heavy jobs
2. **Instance type escalation** — creation of GPU instances (p3, p4d, NC-series, A2) without business justification
3. **Region sprawl** — new instances launched in regions the organization does not normally use
4. **Network indicators** — connections to known mining pools (stratum+tcp://, ports 3333, 4444, 8333, 14444)
5. **Billing spikes** — unexpected cost increases in EC2, Compute Engine, or Azure VMs
6. **Process indicators** — xmrig, ethminer, nbminer, phoenixminer binaries or command-line patterns

### AWS Detection with GuardDuty

```bash
# Check for cryptocurrency-related GuardDuty findings
aws guardduty list-findings --detector-id $DETECTOR_ID \
  --finding-criteria '{
    "Criterion": {
      "type": {
        "Eq": [
          "CryptoCurrency:EC2/BitcoinTool.B",
          "CryptoCurrency:EC2/BitcoinTool.B!DNS",
          "CryptoCurrency:Runtime/BitcoinTool.B",
          "CryptoCurrency:Runtime/BitcoinTool.B!DNS",
          "CryptoCurrency:Lambda/BitcoinTool.B"
        ]
      }
    }
  }'

# Get finding details
aws guardduty get-findings --detector-id $DETECTOR_ID \
  --finding-ids $FINDING_ID --query 'Findings[].{Type:Type,Severity:Severity,Resource:Resource}'
```

### AWS CloudWatch CPU Anomaly Detection

```bash
# Find EC2 instances with sustained high CPU (>90% for 1 hour)
aws cloudwatch get-metric-statistics \
  --namespace AWS/EC2 \
  --metric-name CPUUtilization \
  --dimensions Name=InstanceId,Value=$INSTANCE_ID \
  --start-time $(date -u -d '24 hours ago' +%Y-%m-%dT%H:%M:%S) \
  --end-time $(date -u +%Y-%m-%dT%H:%M:%S) \
  --period 3600 \
  --statistics Average Maximum \
  --query 'Datapoints[?Average>`90.0`]'

# Set CloudWatch alarm for sustained high CPU
aws cloudwatch put-metric-alarm \
  --alarm-name "HighCPU-CryptoDetection-${INSTANCE_ID}" \
  --namespace AWS/EC2 \
  --metric-name CPUUtilization \
  --dimensions Name=InstanceId,Value=$INSTANCE_ID \
  --statistic Average \
  --period 3600 \
  --evaluation-periods 2 \
  --threshold 90 \
  --comparison-operator GreaterThanThreshold \
  --alarm-actions $SNS_TOPIC_ARN
```

### AWS Cost Explorer — Billing Anomaly

```bash
# Check for cost spikes in EC2 over the last 7 days
aws ce get-cost-and-usage \
  --time-period Start=$(date -u -d '7 days ago' +%Y-%m-%d),End=$(date -u +%Y-%m-%d) \
  --granularity DAILY \
  --metrics UnblendedCost \
  --filter '{"Dimensions":{"Key":"SERVICE","Values":["Amazon Elastic Compute Cloud - Compute"]}}' \
  --group-by Type=DIMENSION,Key=REGION

# List EC2 instances by type to find unexpected GPU instances
aws ec2 describe-instances \
  --filters "Name=instance-type,Values=p3.*,p4d.*,g4dn.*,g5.*" \
  --query 'Reservations[].Instances[].{ID:InstanceId,Type:InstanceType,State:State.Name,Launch:LaunchTime,Region:Placement.AvailabilityZone}'
```

### Azure Detection

```bash
# Query Azure Defender for cryptomining alerts
az security alert list --query "[?alertType=='VM_CryptoCoinMiner' || alertType=='K8S_CryptoCoinMiner']" \
  --output table

# Check for high CPU VMs via Azure Monitor
az monitor metrics list \
  --resource $VM_RESOURCE_ID \
  --metric "Percentage CPU" \
  --interval PT1H \
  --start-time $(date -u -d '24 hours ago' +%Y-%m-%dT%H:%M:%SZ) \
  --query "value[0].timeseries[0].data[?average > \`90\`]"

# Find GPU VM instances
az vm list --query "[?contains(hardwareProfile.vmSize,'NC') || contains(hardwareProfile.vmSize,'ND') || contains(hardwareProfile.vmSize,'NV')]" \
  --output table
```

### GCP Detection

```bash
# Query Security Command Center for cryptomining findings
gcloud scc findings list $ORG_ID \
  --filter='category="Malware: Cryptomining Bad Domain" OR category="Malware: Cryptomining Bad IP" OR category="Malware: Cryptomining Pool Domain"' \
  --format=json

# Check Compute Engine instance CPU via Cloud Monitoring
gcloud monitoring time-series list \
  --filter='metric.type="compute.googleapis.com/instance/cpu/utilization" AND resource.labels.instance_id="'$INSTANCE_ID'"' \
  --interval-start-time=$(date -u -d '24 hours ago' +%Y-%m-%dT%H:%M:%SZ) \
  --format=json

# Find GPU instances
gcloud compute instances list \
  --filter="guestAccelerators.acceleratorCount>0" \
  --format="table(name,zone,machineType,status,guestAccelerators)"
```

### Network Indicator Detection

```bash
# AWS VPC Flow Log query for known mining pool ports
aws logs filter-log-events \
  --log-group-name "VPCFlowLogs" \
  --filter-pattern '[version, account, eni, source, destination, srcport, dstport=3333 || dstport=4444 || dstport=8333 || dstport=14444, protocol, packets, bytes, windowstart, windowend, action, flowlogstatus]'

# GCP — query VPC Flow Logs for mining pool connections
gcloud logging read 'resource.type="gce_subnetwork" AND jsonPayload.connection.dest_port=(3333 OR 4444 OR 8333 OR 14444)' \
  --limit 50 --format=json
```

## Workflow

### Step 1: Check Native Security Services

```bash
# AWS — verify GuardDuty is enabled in all regions
for region in $(aws ec2 describe-regions --query 'Regions[].RegionName' --output text); do
  DETECTOR=$(aws guardduty list-detectors --region "$region" --query 'DetectorIds[0]' --output text 2>/dev/null)
  [ "$DETECTOR" = "None" ] || [ -z "$DETECTOR" ] && echo "[GAP] GuardDuty not enabled in $region"
done
```

### Step 2: Audit Compute Usage Across Regions

```bash
# Find instances in unusual regions
EXPECTED_REGIONS="us-east-1 us-west-2 eu-west-1"
for region in $(aws ec2 describe-regions --query 'Regions[].RegionName' --output text); do
  if ! echo "$EXPECTED_REGIONS" | grep -qw "$region"; then
    COUNT=$(aws ec2 describe-instances --region "$region" --query 'length(Reservations[].Instances[])' --output text)
    [ "$COUNT" -gt 0 ] && echo "[ALERT] $COUNT instances in unexpected region: $region"
  fi
done
```

### Step 3: Run Agent Script

```bash
node scripts/agent.js --provider aws --output /tmp/cryptojacking_report.json
```

## Detection

```yaml
title: Cloud Cryptojacking Detection
id: e5a684b5-c938-45d2-8d3c-a3e2ac6a4e28
status: experimental
description: Detects suspicious activity related to detecting cloud cryptojacking techniques in cloud security context
logsource:
  product: aws
  service: cloudtrail
detection:
  selection:
    eventName: "*Unauthorized*"
  condition: selection
level: medium
tags:
  - attack.t1496
  - attack.credential_access
falsepositives:
  - Automated cloud infrastructure provisioning by approved CI/CD pipelines
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Cloud Cryptojacking Detection | aws | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1496 |

## Verification

- [ ] GuardDuty/Defender/SCC enabled in all regions with crypto detection
- [ ] CloudWatch alarms configured for sustained high CPU on all compute
- [ ] Billing alerts set for cost anomaly thresholds
- [ ] VPC Flow Logs enabled and queried for mining pool indicators
- [ ] No unauthorized GPU/compute-optimized instances running
- [ ] Network egress rules block known mining pool ports
- [ ] Runtime protection detects mining process signatures

## References

- [MITRE ATT&CK T1496 — Resource Hijacking](https://attack.mitre.org/techniques/T1496/)
- [AWS GuardDuty Cryptocurrency Findings](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_crypto.html)
- [Azure Defender Cryptomining Detection](https://learn.microsoft.com/en-us/azure/defender-for-cloud/)
- [GCP Security Command Center Threat Detection](https://cloud.google.com/security-command-center/docs/)
