AI Chatbot-Driven Cryptojacking Campaign: Analysis and Defensive Hunting Strategies

---
title: Suspicious Crypto Miner Process Execution
id: 8a4b2c91-6f3e-4a1d-9e2f-3c5a6b7c8d9e
status: experimental
description: Detects the execution of known crypto mining binaries or processes with command-line arguments typical of XMRig and similar miners. This covers the payload delivered via the AI chatbot vector.
references:
  - https://attack.mitre.org/techniques/T1496/
author: Security Arsenal
date: 2026/05/12
tags:
  - attack.resource-hijacking
  - attack.t1496
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|contains:
      - 'xmrig.exe'
      - 'srn.exe'
      - 'minerd.exe'
      - 'cpuminer'
  selection_cli:
    CommandLine|contains:
      - '--donate-level'
      - '--url='
      - 'stratum+tcp'
      - '--coin='
  condition: 1 of selection_
falsepositives:
  - Authorized cryptocurrency mining operations (rare in enterprise)
level: high
---
title: Persistence via Scheduled Task for Crypto Miner
id: 9c5d3e02-0g4f-5b2e-0f3g-4d6b7c8e9f0a
status: experimental
description: Detects the creation of scheduled tasks that execute binaries from suspicious user directories, a common persistence mechanism for cryptojackers delivered via social engineering.
references:
  - https://attack.mitre.org/techniques/T1053/005
author: Security Arsenal
date: 2026/05/12
tags:
  - attack.persistence
  - attack.t1053.005
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4698
    TaskName|contains: 'Update'
    CommandLine|contains:
      - 'AppData\\Roaming'
      - 'AppData\\Local'
      - 'Temp'
  filter:
    SubjectUserName|contains:
      - 'SYSTEM'
      - 'ADMINISTRATOR'
  condition: selection and not filter
falsepositives:
  - Legitimate software update tasks running from user context
level: medium

// Hunt for processes associated with cryptojacking characteristics
// Look for high CPU processes connecting to non-standard ports
let MiningPorts = dynamic([3333, 14444, 8080, 3334, 9999]);
DeviceProcessEvents
| where Timestamp > ago(7d)
| where ProcessVersionInfoCompanyName != "Microsoft Corporation" or isnull(ProcessVersionInfoCompanyName)
| join kind=inner (
    DeviceNetworkEvents
    | where RemotePort in (MiningPorts)
    | summarize ConnectionCount=count() by DeviceId, InitiatingProcessFileName, InitiatingProcessId
) on DeviceId, FileName, ProcessId
| project Timestamp, DeviceName, FileName, FolderPath, InitiatingProcessFileName, RemoteIP, RemotePort, ConnectionCount
| order by Timestamp desc

-- Hunt for suspicious miner processes and config files in user directories
SELECT 
  Pid, 
  Name, 
  CommandLine, 
  Exe, 
  Username 
FROM pslist()
WHERE Name =~ "xmrig" 
   OR Name =~ "minerd" 
   OR CommandLine =~ "stratum+tcp"

-- Hunt for common miner configuration artifacts
SELECT FullPath, Mtime, Size
FROM glob(globs="/*Users/*/AppData/**/config.")
WHERE FullPath =~ "[Cc]onfig"

# Cryptojacking Incident Response - Kill Miner Processes and Block Common Ports
# Requires Admin Privileges

Write-Host "Starting Cryptojacking Remediation..." -ForegroundColor Cyan

# 1. Terminate suspicious mining processes
$suspiciousProcesses = @("xmrig", "minerd", "srn", "cpuminer")
foreach ($proc in Get-Process | Where-Object { $suspiciousProcesses -contains $_.ProcessName }) {
    Write-Host "Terminating process: $($proc.ProcessName) (PID: $($proc.Id))" -ForegroundColor Yellow
    Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue
}

# 2. Block common mining pool ports via Windows Firewall
$miningPorts = @(3333, 14444, 8080)
foreach ($port in $miningPorts) {
    $ruleName = "Block Mining Port $port"
    if (-not (Get-NetFirewallRule -DisplayName $ruleName -ErrorAction SilentlyContinue)) {
        New-NetFirewallRule -DisplayName $ruleName -Direction Outbound -Protocol TCP -LocalPort $port -Action Block
        Write-Host "Created firewall rule to block outbound port $port" -ForegroundColor Green
    } else {
        Write-Host "Firewall rule for port $port already exists." -ForegroundColor Gray
    }
}

Write-Host "Remediation complete. Please investigate AppData/Roaming for malicious artifacts." -ForegroundColor Cyan