<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Detecting Cloud Cryptojacking — API Reference

## AWS CLI Commands

### GuardDuty

```bash
# List detectors
aws guardduty list-detectors --region REGION

# List cryptocurrency findings
aws guardduty list-findings --detector-id DETECTOR_ID \
  --finding-criteria '{"Criterion":{"type":{"Eq":["CryptoCurrency:EC2/BitcoinTool.B"]}}}'

# Get finding details
aws guardduty get-findings --detector-id DETECTOR_ID --finding-ids FINDING_ID
```

### CloudWatch

```bash
# Get CPU utilization for an instance
aws cloudwatch get-metric-statistics --namespace AWS/EC2 --metric-name CPUUtilization \
  --dimensions Name=InstanceId,Value=INSTANCE_ID --period 3600 --statistics Average Maximum \
  --start-time START --end-time END

# Create high-CPU alarm
aws cloudwatch put-metric-alarm --alarm-name NAME --namespace AWS/EC2 \
  --metric-name CPUUtilization --statistic Average --period 3600 \
  --evaluation-periods 2 --threshold 90 --comparison-operator GreaterThanThreshold \
  --alarm-actions SNS_TOPIC_ARN
```

### Cost Explorer

```bash
# Get daily EC2 cost by region
aws ce get-cost-and-usage --time-period Start=START,End=END --granularity DAILY \
  --metrics UnblendedCost \
  --filter '{"Dimensions":{"Key":"SERVICE","Values":["Amazon Elastic Compute Cloud - Compute"]}}' \
  --group-by Type=DIMENSION,Key=REGION
```

### EC2 Instance Inspection

```bash
# Find GPU instances
aws ec2 describe-instances --filters "Name=instance-type,Values=p3.*,p4d.*,g4dn.*,g5.*" \
  --query 'Reservations[].Instances[].{ID:InstanceId,Type:InstanceType,State:State.Name}'

# Find instances in unexpected regions
aws ec2 describe-instances --region REGION --query 'length(Reservations[].Instances[])'
```

## Azure CLI Commands

```bash
# Security alerts for cryptomining
az security alert list --query "[?alertType=='VM_CryptoCoinMiner']"

# VM CPU metrics
az monitor metrics list --resource VM_RESOURCE_ID --metric "Percentage CPU" --interval PT1H

# Find GPU VMs
az vm list --query "[?contains(hardwareProfile.vmSize,'NC')]" --output table
```

## GCP CLI Commands

```bash
# Security Command Center findings
gcloud scc findings list ORG_ID --filter='category="Malware: Cryptomining Bad Domain"'

# CPU utilization metrics
gcloud monitoring time-series list \
  --filter='metric.type="compute.googleapis.com/instance/cpu/utilization"'

# Find GPU instances
gcloud compute instances list --filter="guestAccelerators.acceleratorCount>0"
```

## Known Mining Pool Ports

| Port | Protocol | Usage |
|------|----------|-------|
| 3333 | Stratum | Common mining pool port |
| 4444 | Stratum | Ethash mining pools |
| 8333 | Bitcoin P2P | Bitcoin network |
| 14444 | Stratum | Alternative mining port |
| 14433 | Stratum+TLS | Encrypted mining traffic |

## MITRE ATT&CK Mapping

| Technique | ID | Relevance |
|-----------|----|-----------|
| Resource Hijacking | T1496 | Primary technique for cryptojacking |
| Account Manipulation | T1098 | Credential theft leading to mining |
| Cloud Instance Creation | T1578.002 | Spinning up GPU instances for mining |
