Cryptojacking via AI-Driven SEO Poisoning: Detection and Defense Guide

---
title: Suspicious GPU Miner Process Execution
id: 9c2e6a7f-8b4d-4f3e-9a1c-2d4e5f6a7b8c
status: experimental
description: Detects the execution of known GPU mining processes like XMRig or similar miners which are often used in cryptojacking campaigns.
references:
  - https://attack.mitre.org/techniques/T1496/
author: Security Arsenal
date: 2025/04/07
tags:
  - attack.execution
  - attack.t1496
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|contains:
      - 'xmrig'
      - 'srminer'
      - 'teamredminer'
      - 'nbminer'
    Image|endswith:
      - '.exe'
  condition: selection
falsepositives:
  - Authorized administrative use of mining software
level: high
---
title: PowerShell Downloading Cradles from Non-Corporate Domains
id: b1a2b3c4-5d6e-7f8g-9h0i-1j2k3l4m5n6o
status: experimental
description: Detects PowerShell commands used to download payloads, a common technique in SEO-poisoned malware droppers.
references:
  - https://attack.mitre.org/techniques/T1059/001/
author: Security Arsenal
date: 2025/04/07
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_script:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
  selection_command:
    CommandLine|contains:
      - 'Invoke-WebRequest'
      - 'IEX'
      - 'DownloadString'
  filter_legit:
    CommandLine|contains:
      - 'windowsupdate.com'
      - 'microsoft.com'
  condition: selection_script and selection_command and not filter_legit
falsepositives:
  - Legitimate system administration scripts
level: medium
---
title: Suspicious Installer Executing from User Profile
id: d4e5f6a7-8b9c-0d1e-2f3a-4b5c6d7e8f9a
status: experimental
description: Detects installers or MSI packages running from the User's Downloads or AppData directory, indicative of a trojanized download rather than an admin deployment.
references:
  - https://attack.mitre.org/techniques/T1204/
author: Security Arsenal
date: 2025/04/07
tags:
  - attack.initial_access
  - attack.t1204
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\msiexec.exe'
      - '\setup.exe'
      - '\install.exe'
    ParentImage|contains:
      - '\Downloads\'
      - '\AppData\Local\Temp'
  condition: selection
falsepositives:
  - Users manually installing legitimate software from their downloads
level: low

// Hunt for connections to known mining pools (Stratum protocol)
// Looking for high volume of traffic or specific destination ports
DeviceNetworkEvents
| where ActionType == "ConnectionAccepted" or ActionType == "ConnectionInitiated"
| where RemotePort in (14444, 3333, 8080, 14444)
| summarize count() by DeviceName, RemoteUrl, RemotePort, InitiatingProcessFileName, InitiatingProcessCommandLine
| where count_ > 10

// Hunt for high CPU processes potentially linked to mining
DeviceProcessEvents
| where FileName in~ ("xmrig.exe", "srminer.exe", "nbminer.exe", "cpu-miner.exe")
| extend DeviceCustom = pack_all()

// Hunt for processes running from suspicious locations or matching miner names
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ "xmrig" 
   OR Name =~ "miner" 
   OR Exe =~ "\\Downloads\\.*\\.exe"
   OR Exe =~ "\\AppData\\Local\\Temp\\.*\\.exe"

// Hunt for network connections to mining ports
SELECT Fd.Address, Fd.Port, Fd.RemoteAddress, Pid, StartTime
FROM listen_sockets()
WHERE Port IN (14444, 3333, 8080)

# Remediation Script: Stop Miner Processes and Remove Scheduled Tasks

# Define common miner process names
$minerProcesses = @("xmrig", "srminer", "teamredminer", "nbminer", "cpuminer")

# Kill running processes
foreach ($proc in $minerProcesses) {
    Get-Process -Name $proc -ErrorAction SilentlyContinue | Stop-Process -Force
    Write-Host "Terminated process: $proc"
}

# Remove suspicious scheduled tasks (tasks pointing to user directories)
$suspiciousTasks = Get-ScheduledTask | Where-Object { 
    $_.Actions.Execute -like "*Downloads*" -or 
    $_.Actions.Execute -like "*AppData\Local\Temp*" -or
    $_.Actions.Execute -match "miner|xmrig|rig"
}

foreach ($task in $suspiciousTasks) {
    Unregister-ScheduledTask -TaskName $task.TaskName -Confirm:$false
    Write-Host "Removed scheduled task: $($task.TaskName)"
}

Write-Host "Remediation complete. Please review system logs for additional artifacts."