Detecting Cryptomining in Cloud

When to Use

• When cloud billing alerts indicate unexpected compute cost spikes
• When GuardDuty generates CryptoCurrency or Impact finding types
• When investigating compromised IAM credentials that may be used to launch mining instances
• When monitoring container workloads for unauthorized process execution
• When establishing proactive detection controls against resource hijacking attacks

Do not use for legitimate cryptocurrency mining operations, for non-cloud mining detection on physical hardware, or for general malware analysis unrelated to mining activity.

Prerequisites

• Amazon GuardDuty enabled with Runtime Monitoring for EC2, ECS, and EKS
• CloudWatch or Azure Monitor configured for compute utilization alerting
• VPC Flow Logs enabled for network traffic analysis to mining pool IPs
• AWS Cost Anomaly Detection or Azure Cost Management alerts configured

Workflow

Step 1: Establish Detection Through Multiple Signals

Deploy detection across four signal categories: cost anomalies, compute utilization, network traffic, and runtime processes.

# AWS Cost Anomaly Detection
aws ce create-anomaly-monitor \
  --anomaly-monitor '{
    "MonitorName": "EC2CostSpike",
    "MonitorType": "DIMENSIONAL",
    "MonitorDimension": "SERVICE"
  }'

aws ce create-anomaly-subscription \
  --anomaly-subscription '{
    "SubscriptionName": "CryptoMiningAlert",
    "MonitorArnList": ["arn:aws:ce::123456789012:anomalymonitor/monitor-id"],
    "Subscribers": [{"Address": "security@company.com", "Type": "EMAIL"}],
    "Threshold": 50.0,
    "Frequency": "IMMEDIATE"
  }'

# CloudWatch alarm for CPU utilization spike
aws cloudwatch put-metric-alarm \
  --alarm-name HighCPUUtilization \
  --namespace AWS/EC2 \
  --metric-name CPUUtilization \
  --statistic Average \
  --period 300 \
  --threshold 90 \
  --comparison-operator GreaterThanThreshold \
  --evaluation-periods 3 \
  --alarm-actions "arn:aws:sns:us-east-1:123456789012:security-alerts"

Step 2: Monitor GuardDuty CryptoCurrency Findings

Configure alerting for GuardDuty findings specific to cryptocurrency mining activity on EC2, ECS, and EKS workloads.

Key GuardDuty finding types for cryptomining:

• CryptoCurrency:EC2/BitcoinTool.B - Network connections to crypto-related domains
• CryptoCurrency:Runtime/BitcoinTool.B - Runtime detection of mining process execution
• Impact:EC2/BitcoinTool.B - EC2 instance communicating with known Bitcoin mining pools
• Impact:Runtime/CryptoMinerExecuted - Crypto mining binary execution detected by runtime agent

# EventBridge rule for cryptocurrency findings
aws events put-rule \
  --name CryptoMiningDetection \
  --event-pattern '{
    "source": ["aws.guardduty"],
    "detail-type": ["GuardDuty Finding"],
    "detail": {
      "type": [
        {"prefix": "CryptoCurrency:"},
        {"prefix": "Impact:EC2/BitcoinTool"},
        {"prefix": "Impact:Runtime/CryptoMiner"}
      ]
    }
  }'

# Auto-remediation Lambda for crypto findings
aws events put-targets \
  --rule CryptoMiningDetection \
  --targets '[{
    "Id": "CryptoAutoRemediate",
    "Arn": "arn:aws:lambda:us-east-1:123456789012:function/crypto-remediate"
  }]'

Step 3: Analyze Network Traffic for Mining Pool Connections

Monitor VPC Flow Logs and DNS queries for connections to known cryptocurrency mining pools operating on common ports (3333, 4444, 5555, 8333, 9999, 14444).

// Sentinel KQL query for mining pool connections
AzureNetworkAnalytics_CL
| where TimeGenerated > ago(24h)
| where DestPort_d in (3333, 4444, 5555, 8333, 9999, 14444, 14433, 45700)
| summarize ConnectionCount = count(), BytesSent = sum(BytesSent_d)
            by SrcIP_s, DestIP_s, DestPort_d, bin(TimeGenerated, 1h)
| where ConnectionCount > 10
| project TimeGenerated, SrcIP_s, DestIP_s, DestPort_d, ConnectionCount, BytesSent

# AWS Athena query for VPC Flow Logs mining pool detection
cat << 'EOF' > mining-detection.sql
SELECT srcaddr, dstaddr, dstport, protocol,
       COUNT(*) as connection_count,
       SUM(bytes) as total_bytes
FROM vpc_flow_logs
WHERE dstport IN (3333, 4444, 5555, 8333, 9999, 14444)
  AND action = 'ACCEPT'
  AND start >= date_add('hour', -24, now())
GROUP BY srcaddr, dstaddr, dstport, protocol
HAVING COUNT(*) > 10
ORDER BY connection_count DESC
EOF

Step 4: Detect Mining in Container Environments

…