44 строки
2.3 KiB
YAML
44 строки
2.3 KiB
YAML
id: c094384d-7ea7-4091-83be-18706ecca981
|
|
name: DNS events related to mining pools (Normalized DNS)
|
|
description: |
|
|
'Identifies IP addresses that may be performing DNS lookups associated with common currency mining pools.
|
|
To use this analytics rule, make sure you have deployed the [ASIM normalization parsers](https://aka.ms/AzSentinelDns)'
|
|
severity: Low
|
|
requiredDataConnectors: []
|
|
queryFrequency: 1d
|
|
queryPeriod: 1d
|
|
triggerOperator: gt
|
|
triggerThreshold: 0
|
|
tactics:
|
|
- Impact
|
|
relevantTechniques:
|
|
- T1496
|
|
tags:
|
|
- Id: 0d76e9cf-788d-4a69-ac7d-f234826b5bed
|
|
version: 1.0.0
|
|
- Schema: ASIMDns
|
|
SchemaVersion: 0.1.1
|
|
query: |
|
|
union isfuzzy=true
|
|
(datatable(TimeGenerated:datetime)[]),
|
|
(imDns
|
|
| where DnsQuery has_any ("monerohash.com", "do-dear.com", "xmrminerpro.com", "secumine.net", "xmrpool.com", "minexmr.org", "hashanywhere.com",
|
|
"xmrget.com", "mininglottery.eu", "minergate.com", "moriaxmr.com", "multipooler.com", "moneropools.com", "xmrpool.eu", "coolmining.club",
|
|
"supportxmr.com", "minexmr.com", "hashvault.pro", "xmrpool.net", "crypto-pool.fr", "xmr.pt", "miner.rocks", "walpool.com", "herominers.com",
|
|
"gntl.co.uk", "semipool.com", "coinfoundry.org", "cryptoknight.cc", "fairhash.org", "baikalmine.com", "tubepool.xyz", "fairpool.xyz", "asiapool.io",
|
|
"coinpoolit.webhop.me", "nanopool.org", "moneropool.com", "miner.center", "prohash.net", "poolto.be", "cryptoescrow.eu", "monerominers.net", "cryptonotepool.org",
|
|
"extrmepool.org", "webcoin.me", "kippo.eu", "hashinvest.ws", "monero.farm", "supportxmr.com", "xmrpool.eu", "linux-repository-updates.com", "1gh.com",
|
|
"dwarfpool.com", "hash-to-coins.com", "hashvault.pro", "pool-proxy.com", "hashfor.cash", "fairpool.cloud", "litecoinpool.org", "mineshaft.ml", "abcxyz.stream",
|
|
"moneropool.ru", "cryptonotepool.org.uk", "extremepool.org", "extremehash.com", "hashinvest.net", "unipool.pro", "crypto-pools.org", "monero.net",
|
|
"backup-pool.com", "mooo.com", "freeyy.me", "cryptonight.net", "shscrypto.net")
|
|
| extend timestamp = TimeGenerated, IPCustomEntity = SrcIpAddr, HostCustomEntity = Dvc)
|
|
entityMappings:
|
|
- entityType: Host
|
|
fieldMappings:
|
|
- identifier: FullName
|
|
columnName: HostCustomEntity
|
|
- entityType: IP
|
|
fieldMappings:
|
|
- identifier: Address
|
|
columnName: IPCustomEntity
|
|
version: 1.1.0 |