does anyone here have a query how to detect possible malware

Question

does anyone here have a query how to detect possible malware for crypto mining

8p8c · Answer

you have two ways to approach this collect all network and process data and do the specific searches to determine crypto mining on the log aggregation side hone the queries so you ll hit most of the mining ioc s and only collect when searches produce the output

8p8c · Answer

i personally would lean on the first option as that gives you ability to go back in time and have some kind of way to adjust for noise and changing landscape of miners

8p8c · Answer

the latter option can give you results also but very much depends on how much there is toleration for noise or things to slip through

R0n · Answer

so it would be getting all network and process in a query setup a Pack i assume to run x times a day and monitor that correct

8p8c · Answer

i think yes by nature miners usually have to be long running processes so they have to stick around and probably connect to certain ips

R0n · Answer

+1