detecting-cloud-cryptomining-activity

What this skill does

# Detecting Cloud Cryptomining Activity

## When to Use

- When investigating unexpected spikes in cloud compute costs or CPU utilization
- When GuardDuty, Defender for Cloud, or SCC reports cryptocurrency-related findings
- When monitoring for compromised credentials being used to launch mining instances
- When building detection rules for unauthorized workload deployment in cloud environments
- When responding to alerts about network connections to known mining pool infrastructure

**Do not use** for detecting cryptomining on endpoints or on-premises servers (use EDR tools), for investigating the financial impact of mining (use cloud cost management tools), or for blocking mining at the network level (use DNS filtering and firewall rules).

## Prerequisites

- AWS GuardDuty enabled across all accounts and regions
- Azure Defender for Cloud with server and container plans enabled
- GCP Security Command Center with Event Threat Detection enabled
- CloudTrail, Azure Activity Log, and GCP Audit Log enabled for API monitoring
- Cloud cost monitoring and alerting configured (AWS Cost Anomaly Detection, Azure Cost Management)
- Network flow logs enabled (VPC Flow Logs, NSG Flow Logs, VPC Flow Logs)

## Workflow

### Step 1: Identify GuardDuty Cryptocurrency Findings (AWS)

Query GuardDuty for cryptocurrency-specific finding types that indicate mining activity.

```bash
# List active cryptocurrency-related findings
aws guardduty list-findings \
  --detector-id $(aws guardduty list-detectors --query 'DetectorIds[0]' --output text) \
  --finding-criteria '{
    "Criterion": {
      "type": {
        "Eq": [
          "CryptoCurrency:EC2/BitcoinTool.B!DNS",
          "CryptoCurrency:EC2/BitcoinTool.B",
          "CryptoCurrency:Runtime/BitcoinTool.B!DNS",
          "CryptoCurrency:Runtime/BitcoinTool.B",
          "CryptoCurrency:Lambda/BitcoinTool.B"
        ]
      },
      "service.archived": {"Eq": ["false"]}
    }
  }' --output json

# Get detailed findings
FINDING_IDS=$(aws guardduty list-findings \
  --detector-id $(aws guardduty list-detectors --query 'DetectorIds[0]' --output text) \
  --finding-criteria '{"Criterion":{"type":{"Eq":["CryptoCurrency:EC2/BitcoinTool.B!DNS"]}}}' \
  --query 'FindingIds' --output json)

aws guardduty get-findings \
  --detector-id $(aws guardduty list-detectors --query 'DetectorIds[0]' --output text) \
  --finding-ids $FINDING_IDS \
  --query 'Findings[*].{Type:Type,Severity:Severity,Resource:Resource.InstanceDetails.InstanceId,RemoteIP:Service.Action.NetworkConnectionAction.RemoteIpDetails.IpAddressV4,Domain:Service.Action.DnsRequestAction.Domain}' \
  --output table
```

### Step 2: Detect Compute Usage Anomalies

Monitor for unexpected compute resource provisioning and CPU utilization spikes that indicate mining.

```bash
# AWS: Find recently launched large instances (mining often uses c5/p3/g4 instances)
aws ec2 describe-instances \
  --filters "Name=instance-state-name,Values=running" \
  --query 'Reservations[*].Instances[*].[InstanceId,InstanceType,LaunchTime,Tags[?Key==`Name`].Value|[0]]' \
  --output table | grep -E "c5\.|c6\.|p3\.|p4\.|g4\.|g5\."

# AWS: Check for high CPU utilization
aws cloudwatch get-metric-statistics \
  --namespace AWS/EC2 \
  --metric-name CPUUtilization \
  --dimensions Name=InstanceId,Value=i-SUSPECT_INSTANCE \
  --start-time 2026-02-22T00:00:00Z \
  --end-time 2026-02-23T00:00:00Z \
  --period 3600 \
  --statistics Average \
  --query 'Datapoints[*].[Timestamp,Average]' --output table

# AWS: Check Cost Anomaly Detection
aws ce get-anomalies \
  --date-interval '{"StartDate":"2026-02-16","EndDate":"2026-02-23"}' \
  --query 'Anomalies[*].[AnomalyId,AnomalyScore.MaxScore,Impact.TotalImpact,RootCauses[0].Service]' \
  --output table

# Azure: Find VMs with unusual CPU patterns
az monitor metrics list \
  --resource /subscriptions/SUB_ID/resourceGroups/RG/providers/Microsoft.Compute/virtualMachines/VM_NAME \
  --metric "Percentage CPU" \
  --interval PT1H \
  --start-time 2026-02-22T00:00:00Z \
  --end-time 2026-02-23T00:00:00Z
```

### Step 3: Analyze Network Traffic for Mining Pool Connections

Identify network connections to known cryptocurrency mining pools and Stratum protocol traffic.

```bash
# Query VPC Flow Logs for connections to known mining pool ports (3333, 4444, 8333, 14444)
# AWS: Using CloudWatch Logs Insights
aws logs start-query \
  --log-group-name vpc-flow-logs \
  --start-time $(date -d "24 hours ago" +%s) \
  --end-time $(date +%s) \
  --query-string '
    fields @timestamp, srcAddr, dstAddr, dstPort, bytes
    | filter dstPort in [3333, 4444, 8333, 14444, 14433, 45700]
    | sort bytes desc
    | limit 100
  '

# Check DNS queries for mining pool domains
aws logs start-query \
  --log-group-name route53-resolver-logs \
  --start-time $(date -d "24 hours ago" +%s) \
  --end-time $(date +%s) \
  --query-string '
    fields @timestamp, query_name, srcids.instance
    | filter query_name like /pool|mining|xmr|monero|nicehash|ethermine|f2pool|nanopool/
    | limit 100
  '

# GCP: Query VPC Flow Logs for mining connections
gcloud logging read '
  resource.type="gce_subnetwork"
  AND jsonPayload.connection.dest_port=(3333 OR 4444 OR 8333 OR 14444)
  AND timestamp>="2026-02-22T00:00:00Z"
' --limit=50 --format=json
```

### Step 4: Investigate Container and Serverless Mining

Check for cryptomining within container workloads and serverless functions.

```bash
# EKS/Kubernetes: Find pods with high CPU usage
kubectl top pods --all-namespaces --sort-by=cpu | head -20

# Find suspicious container images
kubectl get pods --all-namespaces -o json | python3 -c "
import json, sys
data = json.load(sys.stdin)
suspicious = ['xmrig', 'monero', 'miner', 'crypto', 'pool', 'hashrate']
for pod in data['items']:
    ns = pod['metadata']['namespace']
    name = pod['metadata']['name']
    for container in pod['spec'].get('containers', []):
        image = container.get('image', '').lower()
        if any(s in image for s in suspicious):
            print(f'SUSPICIOUS: {ns}/{name} -> image: {container[\"image\"]}')
"

# Check Lambda function for mining (unusual duration and memory)
aws lambda list-functions --query 'Functions[*].[FunctionName,MemorySize,Timeout]' --output table
aws cloudwatch get-metric-statistics \
  --namespace AWS/Lambda \
  --metric-name Duration \
  --dimensions Name=FunctionName,Value=SUSPECT_FUNCTION \
  --start-time 2026-02-22T00:00:00Z \
  --end-time 2026-02-23T00:00:00Z \
  --period 3600 \
  --statistics Average Maximum
```

### Step 5: Trace the Attack Vector

Investigate how the mining infrastructure was deployed by analyzing API logs and credential usage.

```bash
# AWS: Find who launched suspect instances
aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=ResourceType,AttributeValue=AWS::EC2::Instance \
  --start-time 2026-02-20T00:00:00Z \
  --query 'Events[?contains(Resources[0].ResourceName, `i-SUSPECT`)].[EventTime,EventName,Username,SourceIPAddress]' \
  --output table

# Check for leaked credentials being used
aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=AccessKeyId,AttributeValue=AKIA_SUSPECT_KEY \
  --query 'Events[*].[EventTime,EventName,SourceIPAddress,EventSource]' \
  --output table

# Check for unusual API calls (RunInstances from new IPs)
aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=EventName,AttributeValue=RunInstances \
  --start-time 2026-02-20T00:00:00Z \
  --query 'Events[*].[EventTime,Username,SourceIPAddress]' \
  --output table
```

### Step 6: Contain and Remediate

Isolate mining resources, revoke compromised credentials, and implement preventive controls.

```bash
# Terminate mining instances
aws ec2 terminate-instances --instance-ids i-MINING_INSTANCE_1 i-MINING_INSTANCE_2

# Deactivate compromised credentials
aws iam update-access-key --user-name compromised-user \
  --access-key-id AKIA_COMPROMISED --status Inactive

# Add SCP to prevent large instance types in non-production