Sigma rule: DNS Events Related To Mining Pools

Rule

Title

DNS Events Related To Mining Pools

Status

test

Level

low

Author

Saw Winn Naung, Azure-Sentinel, @neu5ron

Date

2021-08-19

Modified

2022-07-07

File

rules/network/zeek/zeek_dns_mining_pools.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Identifies clients that may be performing DNS lookups associated with common currency mining pools.

Log source

product

zeek

service

dns

Detection

selection:
    query|endswith:
        - 'monerohash.com'
        - 'do-dear.com'
        - 'xmrminerpro.com'
        - 'secumine.net'
        - 'xmrpool.com'
        - 'minexmr.org'
        - 'hashanywhere.com'
        - 'xmrget.com'
        - 'mininglottery.eu'
        - 'minergate.com'
        - 'moriaxmr.com'
        - 'multipooler.com'
        - 'moneropools.com'
        - 'xmrpool.eu'
        - 'coolmining.club'
        - 'supportxmr.com'
        - 'minexmr.com'
        - 'hashvault.pro'
        - 'xmrpool.net'
        - 'crypto-pool.fr'
        - 'xmr.pt'
        - 'miner.rocks'
        - 'walpool.com'
        - 'herominers.com'
        - 'gntl.co.uk'
        - 'semipool.com'
        - 'coinfoundry.org'
        - 'cryptoknight.cc'
        - 'fairhash.org'
        - 'baikalmine.com'
        - 'tubepool.xyz'
        - 'fairpool.xyz'
        - 'asiapool.io'
        - 'coinpoolit.webhop.me'
        - 'nanopool.org'
        - 'moneropool.com'
        - 'miner.center'
        - 'prohash.net'
        - 'poolto.be'
        - 'cryptoescrow.eu'
        - 'monerominers.net'
        - 'cryptonotepool.org'
        - 'extrmepool.org'
        - 'webcoin.me'
        - 'kippo.eu'
        - 'hashinvest.ws'
        - 'monero.farm'
        - 'linux-repository-updates.com'
        - '1gh.com'
        - 'dwarfpool.com'
        - 'hash-to-coins.com'
        - 'pool-proxy.com'
        - 'hashfor.cash'
        - 'fairpool.cloud'
        - 'litecoinpool.org'
        - 'mineshaft.ml'
        - 'abcxyz.stream'
        - 'moneropool.ru'
        - 'cryptonotepool.org.uk'
        - 'extremepool.org'
        - 'extremehash.com'
        - 'hashinvest.net'
        - 'unipool.pro'
        - 'crypto-pools.org'
        - 'monero.net'
        - 'backup-pool.com'
        - 'mooo.com' # Dynamic DNS, may want to exclude
        - 'freeyy.me'
        - 'cryptonight.net'
        - 'shscrypto.net'
exclude_answers:
    answers:
        - '127.0.0.1'
        - '0.0.0.0'
exclude_rejected:
    rejected: 'true'
condition: selection and not 1 of exclude_*

False positives (as the rule lists them)

• A DNS lookup does not necessarily mean a successful attempt, verify a) if there was a response using the zeek answers field, if there was then verify the connections (conn.log) to those IPs. b) verify if HTTP, SSL, or TLS activity to the domain that was queried. http.log field is 'host' and ssl/tls is 'server_name'.

Tags

• attack.execution
• attack.t1569.002
• attack.impact
• attack.t1496

MITRE ATT&CK ids this rule names

• T1496
• T1569.002

References

• https://github.com/Azure/Azure-Sentinel/blob/fa0411f9424b6c47b4d5a20165e4f1b168c1f103/Detections/ASimDNS/imDNS_Miners.yaml

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/network/zeek/zeek_dns_mining_pools.yml