<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
# Cryptomining Detection — API Reference

## Known Mining Pool Ports

| Port | Protocol | Common Pools |
|------|----------|-------------|
| 3333 | Stratum | General mining |
| 4444 | Stratum | Ethash pools |
| 5555 | Stratum | Monero pools |
| 8333 | Bitcoin P2P | Bitcoin network |
| 14433 | Stratum+TLS | Encrypted stratum |
| 14444 | Stratum+TLS | Encrypted stratum |

## kubectl Resource Commands

```bash
kubectl top pods -n NAMESPACE --sort-by=cpu
kubectl get pods -n NAMESPACE -o json | jq '.items[].spec.containers[] | {name, resources}'
kubectl describe pod POD -n NAMESPACE | grep -A5 "Limits\|Requests"
```

## Prometheus Queries

```promql
# High CPU containers
rate(container_cpu_usage_seconds_total{container!=""}[5m]) > 0.9

# CPU usage vs limits ratio
rate(container_cpu_usage_seconds_total[5m])
  / on(pod,namespace,container)
  kube_pod_container_resource_limits{resource="cpu"} > 0.95
```

## Falco Rule Fields for Mining

| Field | Usage |
|-------|-------|
| `proc.name` | Match known miner binary names |
| `proc.cmdline` | Match stratum protocol arguments |
| `fd.sport` | Match mining pool ports |
| `fd.sip.name` | Match mining pool hostnames |
| `container.image.repository` | Flag known miner images |
