<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Cloud Cryptomining Detection — API Reference

## AWS CLI Commands

### GuardDuty

```bash
# List detectors
aws guardduty list-detectors

# List crypto-related findings
aws guardduty list-findings --detector-id DETECTOR_ID \
  --finding-criteria '{"Criterion":{"type":{"Eq":["CryptoCurrency:EC2/BitcoinTool.B!DNS"]}}}'

# Get finding details
aws guardduty get-findings --detector-id DETECTOR_ID --finding-ids FINDING_ID
```

### Compute Monitoring

```bash
# CPU utilization for instance
aws cloudwatch get-metric-statistics --namespace AWS/EC2 --metric-name CPUUtilization \
  --dimensions Name=InstanceId,Value=INSTANCE_ID --period 3600 --statistics Average \
  --start-time START --end-time END

# List running GPU instances
aws ec2 describe-instances --filters "Name=instance-state-name,Values=running" \
  --query 'Reservations[].Instances[?starts_with(InstanceType,`p3`) || starts_with(InstanceType,`g4`)]'
```

### Cost Anomaly Detection

```bash
# Create anomaly monitor
aws ce create-anomaly-monitor --anomaly-monitor '{"MonitorName":"compute","MonitorType":"DIMENSIONAL","MonitorDimension":"SERVICE"}'

# Get anomalies
aws ce get-anomalies --date-interval '{"StartDate":"2026-03-01","EndDate":"2026-03-17"}'
```

### Network Analysis

```bash
# VPC Flow Logs — check for mining ports (via Athena)
# SELECT srcaddr, dstaddr, dstport, bytes FROM vpc_flow_logs
# WHERE dstport IN (3333,4444,5555,7777,8333) AND action='ACCEPT'
```

## Azure CLI Commands

```bash
# Defender alerts for cryptomining
az security alert list --query "[?contains(alertType, 'MINING')]"

# VM CPU metrics
az monitor metrics list --resource VM_RESOURCE_ID --metric "Percentage CPU" --interval PT1H

# Cost analysis
az costmanagement query --type ActualCost --timeframe MonthToDate --dataset-filter '{}'
```

## GCP CLI Commands

```bash
# SCC findings for cryptomining
gcloud scc findings list ORGANIZATION_ID --filter="category=\"CRYPTO_MINING\""

# Compute CPU metrics
gcloud monitoring time-series list --filter='metric.type="compute.googleapis.com/instance/cpu/utilization"'

# Billing anomalies
gcloud billing budgets list --billing-account=ACCOUNT_ID
```

## Common Mining Pool Ports

| Port | Protocol | Usage |
|------|----------|-------|
| 3333 | Stratum | General mining |
| 4444 | Stratum | Ethash mining |
| 5555 | Stratum | Monero mining |
| 8333 | Bitcoin P2P | Bitcoin node |
| 14444 | Stratum+TLS | Encrypted mining |
