Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

does anyone here have a query how to detect possible malware for crypto-mining?

you have two ways to approach this:
• collect all network and process data and do the specific searches to determine crypto mining on the log aggregation side 
• hone the queries so you'll hit most of the mining ioc's and only collect when searches produce the output.

i personally would lean on the first option as that gives you ability to go back in time and have some kind of way to adjust for noise and changing landscape of miners.

the latter option can give you results also but very much depends on how much there is toleration for noise or things to slip through.

so it would be getting all network and process in a query. setup a Pack i assume to run x times a day and monitor that correct?

i think yes.
by nature miners usually have to be long running processes, so they have to stick around and probably connect to certain ips.