<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: detecting-cryptomining-in-containers
description: >-
  Detect cryptocurrency mining activity in containers using process monitoring,
  resource anomaly detection, network traffic analysis, and Falco rules to
  identify both known miners and behavior-based indicators.
domain: cybersecurity
subdomain: container-security
tags:
  - cryptomining
  - detection
  - falco
  - resource-monitoring
  - threat-detection
  - network-analysis
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1496"]
---

# Detecting Cryptomining in Containers

## Overview

Cryptomining is the most common post-exploitation activity in container
environments. Attackers deploy miners via compromised images, vulnerable
applications, or supply chain attacks. This skill covers detection through
known process signatures, Falco runtime rules, CPU anomaly alerting, and
network-based identification of stratum protocol connections to mining pools.

Mode: `[MODE: BLUE]` — Defensive threat detection.

## Prerequisites

| Requirement | Details |
|---|---|
| Falco >= 0.37 for runtime detection | Required |
| Prometheus + Grafana for resource monitoring | Required |
| kubectl for cluster inspection | Required |
| Network policy logs for traffic analysis | Required |

## Key Concepts

### Known Cryptominer Process Detection

```bash
# Common miner process names
MINER_PROCESSES="xmrig|minerd|ccminer|cgminer|cpuminer|nbminer|t-rex|lolminer"

# Find mining processes in containers
docker ps -q | xargs -I{} docker top {} | grep -iE "$MINER_PROCESSES"

# Kubernetes: find high-CPU pods
kubectl top pods --all-namespaces --sort-by=cpu | head -20
```

### Falco Rules for Cryptomining

```yaml
- rule: Detect Cryptomining Process
  desc: Detects known cryptocurrency mining processes in containers
  condition: >
    spawned_process and container and
    (proc.name in (xmrig, minerd, ccminer, cgminer, cpuminer,
                   bfgminer, nbminer, t-rex, lolminer, phoenixminer)
     or proc.args contains "stratum+tcp"
     or proc.args contains "stratum+ssl"
     or proc.args contains "--donate-level"
     or proc.args contains "-o pool.")
  output: >
    Cryptomining process detected in container
    (user=%user.name command=%proc.cmdline container=%container.name
     image=%container.image.repository)
  priority: CRITICAL
  tags: [container, cryptomining, mitre_resource_hijacking, T1496]

- rule: Container Stratum Connection
  desc: Detects connections to mining pool stratum protocol
  condition: >
    outbound and container and
    (fd.sport in (3333, 4444, 5555, 8333, 9999, 14433, 14444)
     or fd.sip.name contains "pool."
     or fd.sip.name contains "mining."
     or fd.sip.name contains "nanopool"
     or fd.sip.name contains "f2pool")
  output: >
    Mining pool connection from container
    (container=%container.name image=%container.image.repository
     connection=%fd.name)
  priority: CRITICAL
  tags: [container, cryptomining, network, T1496]
```

### Resource Anomaly Detection

```yaml
# Prometheus alert rule
groups:
  - name: cryptomining
    rules:
      - alert: PossibleCryptomining
        expr: |
          rate(container_cpu_usage_seconds_total{container!=""}[5m]) > 0.9
        for: 10m
        labels:
          severity: critical
        annotations:
          summary: "Possible cryptomining in {{ $labels.pod }}"
```

## Workflow

### Step 1: Scan for Known Mining Processes

```bash
node scripts/agent.js --scan-processes --namespace default --output /tmp/mining-scan.json
```

### Step 2: Analyze Resource Anomalies

```bash
node scripts/agent.js --check-resources --threshold 0.9 --output /tmp/resource-report.json
```

### Step 3: Deploy Falco Detection Rules

```bash
kubectl apply -f mining-detection-rules.yaml
```

## Detection

```yaml
title: Cryptomining In Containers Detection
id: 1b5ae1ff-7d15-4029-a1d4-e48ba32f062a
status: experimental
description: Detects suspicious activity related to detecting cryptomining in containers techniques in container security context
logsource:
  product: kubernetes
  service: audit
detection:
  selection:
    eventName: "*Unauthorized*"
  condition: selection
level: medium
tags:
  - attack.t1496
  - attack.execution
falsepositives:
  - Container orchestration platform performing routine health checks
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Cryptomining In Containers Detection | kubernetes | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1496 |

## Verification

- [ ] Falco rules detect known miner processes within 10 seconds
- [ ] Stratum protocol connections trigger network alerts
- [ ] CPU anomaly detection fires for sustained >90% usage
- [ ] DNS queries to mining pools are flagged
- [ ] Image scanning catches known miner binaries pre-deployment
- [ ] Network policies block common mining pool ports

## References

- [MITRE ATT&CK T1496 — Resource Hijacking](https://attack.mitre.org/techniques/T1496/)
- [Falco Cloud Detection Rules](https://falco.org/docs/rules/)
- [CIS Kubernetes Benchmark — Resource Limits](https://www.cisecurity.org/benchmark/kubernetes)
- [NIST SP 800-190 §4.4 — Container Runtime Threats](https://csrc.nist.gov/publications/detail/sp/800-190/final)
