Analytics BIOC
Medium
✕
A Possible crypto miner was detected on a host
The host produced traffic consistent with the crypto mining.
- Module:
- Platform Analytics
- Data source:
- Palo Alto Networks Firewall traffic Logs, XDR Agent
ATT&CK tactics: Impact (TA0040)
ATT&CK techniques: Resource Hijacking (T1496)
Attacker's goals:
Abuse resources to mine crypto coins.
Investigative actions:
Check the host for crypto mining client software. Look for differences in the resource consumption from this host. Examine the client's network traffic for suspicious domains affiliated with mining or mining pools.
- Test period:
- N/A (single event)
- Deduplication:
- 1 Day