Sigma rule: Possible Coin Miner CPU Priority Param

Rule

Title

Possible Coin Miner CPU Priority Param

Status

test

Level

critical

Author

Florian Roth (Nextron Systems)

Date

2021-10-09

Modified

2022-12-25

File

rules/linux/auditd/execve/lnx_auditd_coinminer.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects command line parameter very often used with coin miners

Log source

product

linux

service

auditd

Detection

cmd1:
    a1|startswith: '--cpu-priority'
cmd2:
    a2|startswith: '--cpu-priority'
cmd3:
    a3|startswith: '--cpu-priority'
cmd4:
    a4|startswith: '--cpu-priority'
cmd5:
    a5|startswith: '--cpu-priority'
cmd6:
    a6|startswith: '--cpu-priority'
cmd7:
    a7|startswith: '--cpu-priority'
condition: 1 of cmd*

False positives (as the rule lists them)

• Other tools that use a --cpu-priority flag

Tags

• attack.privilege-escalation
• attack.t1068

MITRE ATT&CK ids this rule names

• T1068

References

• https://xmrig.com/docs/miner/command-line-options

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/linux/auditd/execve/lnx_auditd_coinminer.yml