<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: detecting-cloud-cryptomining
description: >-
  Detect unauthorized cryptocurrency mining activity across AWS, Azure, and GCP
  using compute anomaly detection, network analysis, and cloud-native security tools.
domain: cybersecurity
subdomain: cloud-security
tags:
  - cryptomining
  - detection
  - aws
  - azure
  - gcp
  - guardduty
  - cost-anomaly
  - compute
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1496"]
---

# Detecting Cloud Cryptomining

## Overview

Cryptomining is the most common financially-motivated cloud attack. Attackers exploit
compromised credentials, misconfigured services, or vulnerable applications to launch
compute-intensive mining operations. This skill covers detection through compute usage
anomalies, network traffic analysis, billing alerts, and cloud-native detection services.

Mode: `[MODE: BLUE]` — Detection and rapid response.

## Prerequisites

- AWS CLI, Azure CLI, or gcloud CLI configured
- Permissions: CloudWatch metrics, VPC Flow Logs, billing data, GuardDuty/Defender/SCC
- Python 3.10+ with `boto3` / `azure-mgmt-compute` / `google-cloud-monitoring`
- Network monitoring: VPC Flow Logs or NSG Flow Logs enabled

## Key Concepts

### Cryptomining Indicators

| Indicator | Detection Method | Confidence |
|-----------|-----------------|-----------|
| Sustained high CPU (>90%) on new instances | CloudWatch/Azure Monitor/Cloud Monitoring | High |
| Connections to mining pool IPs/domains | VPC Flow Logs + threat intel | High |
| Stratum protocol traffic (port 3333, 4444, 8333) | Flow logs / packet inspection | High |
| Spike in compute spend | Billing alerts / Cost Anomaly Detection | Medium |
| GPU instance launches in unusual regions | CloudTrail / Activity Log | High |
| New large instance types (p3, p4, g4) | CloudTrail / Activity Log | Medium |
| Container with mining binary | Container image scanning | High |

### Mining Pool Network Indicators

Common mining pool ports and protocols:

```bash
# Common stratum mining ports
MINING_PORTS="3333,4444,5555,7777,8333,8888,9999,14433,14444"

# Check VPC Flow Logs for connections to mining ports
aws ec2 describe-flow-logs --query 'FlowLogs[].FlowLogId'

# Athena query for mining port connections
# SELECT srcaddr, dstaddr, dstport, bytes, packets
# FROM vpc_flow_logs
# WHERE dstport IN (3333,4444,5555,7777,8333,8888,9999,14433,14444)
# AND action = 'ACCEPT'
# AND date > date_add('day', -7, now())
# ORDER BY bytes DESC;
```

### GuardDuty CryptoMining Findings

```bash
DETECTOR=$(aws guardduty list-detectors --query 'DetectorIds[0]' --output text)

# List cryptomining findings
aws guardduty list-findings --detector-id $DETECTOR \
  --finding-criteria '{"Criterion":{"type":{"Eq":["CryptoCurrency:EC2/BitcoinTool.B!DNS","CryptoCurrency:EC2/BitcoinTool.B","Impact:EC2/BitcoinDomainRequest.Reputation"]}}}' | \
  jq '.FindingIds'
```

### Compute Anomaly Detection

```bash
# AWS — Check for unusual CPU utilization across all instances
aws cloudwatch get-metric-statistics \
  --namespace AWS/EC2 --metric-name CPUUtilization \
  --dimensions Name=InstanceId,Value=$INSTANCE_ID \
  --start-time "$(date -u -d '24 hours ago' +%Y-%m-%dT%H:%M:%S)" \
  --end-time "$(date -u +%Y-%m-%dT%H:%M:%S)" \
  --period 300 --statistics Average \
  --query 'Datapoints[?Average>`90`]'

# Azure — Check VM CPU metrics
az monitor metrics list --resource $VM_RESOURCE_ID \
  --metric "Percentage CPU" --interval PT1H --start-time "2026-03-16" \
  --query "value[0].timeseries[0].data[?average > \`90\`]"

# GCP — Check Compute Engine CPU
gcloud monitoring time-series list \
  --filter='metric.type="compute.googleapis.com/instance/cpu/utilization" AND resource.labels.instance_id="INSTANCE_ID"' \
  --interval-start-time="2026-03-16T00:00:00Z"
```

### Cost Anomaly Detection

```bash
# AWS — Enable Cost Anomaly Detection
aws ce create-anomaly-monitor --anomaly-monitor '{
  "MonitorName": "compute-anomaly",
  "MonitorType": "DIMENSIONAL",
  "MonitorDimension": "SERVICE"
}'

# Check for cost anomalies
aws ce get-anomalies --date-interval '{"StartDate":"2026-03-01","EndDate":"2026-03-17"}' \
  --query 'Anomalies[?AnomalyScore.CurrentScore > `0.7`]'
```

## Workflow

### Step 1: Check Cloud-Native Detections

```bash
# GuardDuty cryptomining findings
node scripts/agent.js --provider aws --check guardduty --output /tmp/mining_findings.json

# Azure Defender alerts
az security alert list --query "[?contains(alertType, 'CryptoCurrency')]"
```

### Step 2: Analyze Compute Patterns

```bash
node scripts/agent.js --provider aws --check compute --days 7 --output /tmp/compute_anomalies.json
```

### Step 3: Check Network Indicators

```bash
node scripts/agent.js --provider aws --check network --output /tmp/network_findings.json
```

### Step 4: Respond

Isolate compromised instances, revoke credentials, and investigate root cause.

## Detection

```yaml
title: Cloud Cryptomining Detection
id: b9a6963e-6f19-44ec-9b43-8b943e19b1ce
status: experimental
description: Detects suspicious activity related to detecting cloud cryptomining techniques in cloud security context
logsource:
  product: aws
  service: cloudtrail
detection:
  selection:
    eventName: "*Unauthorized*"
  condition: selection
level: medium
tags:
  - attack.t1496
  - attack.credential_access
falsepositives:
  - Automated cloud infrastructure provisioning by approved CI/CD pipelines
```

## Verification

- [ ] GuardDuty/Defender/SCC enabled with cryptomining detection
- [ ] Billing alerts configured for compute spend anomalies
- [ ] VPC Flow Logs enabled and analyzed for mining pool connections
- [ ] No instances with sustained >90% CPU without business justification
- [ ] GPU/large compute instances restricted by SCP/policy
- [ ] DNS query logging enabled to detect mining pool domains

## References

- [AWS GuardDuty — Cryptocurrency Finding Types](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-ec2.html)
- [MITRE ATT&CK T1496 — Resource Hijacking](https://attack.mitre.org/techniques/T1496/)
- [Azure Defender for Servers — Threat Detection](https://learn.microsoft.com/en-us/azure/defender-for-cloud/)
- [GCP Security Command Center](https://cloud.google.com/security-command-center/docs)
