Linux PAM Abuse: Detecting XMRig Cryptominers Hiding as Low-Privilege Users

---
title: Linux PAM Configuration Modification
id: 8a4d2c91-5f6e-4b8a-9c1d-2e3f4a5b6c7d
status: experimental
description: Detects modifications to PAM configuration directories which may indicate persistence mechanism abuse.
references:
 - https://attack.mitre.org/techniques/T1543/003/
author: Security Arsenal
date: 2026/04/06
tags:
 - attack.persistence
 - attack.t1543.003
logsource:
  category: file_change
  product: linux
detection:
  selection:
    TargetFilename|contains: '/etc/pam.d/'
  condition: selection
falsepositives:
  - Legitimate administrative changes to authentication policies
level: high
---
title: XMRig Execution as Non-Root User
id: 9b5e3d02-6g7f-5c9b-0d2e-3f4g5a6b7c8e
status: experimental
description: Detects execution of XMRig or common miner names by non-root users, indicating evasion techniques.
references:
 - https://attack.mitre.org/techniques/T1059/004/
author: Security Arsenal
date: 2026/04/06
tags:
 - attack.execution
 - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith:
      - '/xmrig'
      - '/miner'
    User|contains:
      - 'www-data'
      - 'nobody'
      - 'ubuntu'
      - 'daemon'
  filter:
    User|contains: 'root'
  condition: selection and not filter
falsepositives:
  - Authorized benchmarking by developers
level: high
---
title: Suspicious Outbound Connection to Mining Pool
id: 0c6f4e13-7h8g-6d0c-1e3f-4g5h6a7b8c9d
status: experimental
description: Detects network connections to known mining ports (commonly 3333, 14444, 8080) initiated by non-system binaries.
references:
 - https://attack.mitre.org/techniques/T1071/001/
author: Security Arsenal
date: 2026/04/06
tags:
 - attack.command_and_control
 - attack.t1071.001
logsource:
  category: network_connection
  product: linux
detection:
  selection_ports:
    DestinationPort:
      - 3333
      - 14444
      - 8080
      - 3357
  selection_process:
    Image|notcontains:
      - '/usr/bin'
      - '/usr/sbin'
      - '/bin'
  condition: all of selection_*
falsepositives:
  - Legitimate traffic to services running on non-standard ports
level: medium

// Hunt for XMRig processes running under non-root accounts
DeviceProcessEvents
| where Timestamp > ago(7d)
| where ProcessName has "xmrig" or FileName has "xmrig"
| where AccountName != "root" and AccountName !contains "SYSTEM"
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName
| order by Timestamp desc

// Hunt for file modifications in /etc/pam.d/
DeviceFileEvents
| where Timestamp > ago(7d)
| where FolderPath startswith @"/etc/pam.d/"
| project Timestamp, DeviceName, ActionType, FileName, InitiatingProcessAccountName, InitiatingProcessCommandLine
| where ActionType in ("FileModified", "FileCreated")

-- Hunt for XMRig execution artifacts and PAM tampering
SELECT 
  Pid, 
  Name, 
  Username, 
  CommandLine, 
  Exe
FROM pslist()
WHERE Name =~ 'xmrig'
   OR CommandLine =~ 'stratum+tcp'

-- Check for recent modifications to PAM configuration files
SELECT 
  FullPath, 
  Mtime, 
  Size, 
  Mode
FROM glob(globs="/etc/pam.d/*")
WHERE Mtime > now() - 7 * 86400  

-- Hunt for network connections associated with mining pools
SELECT 
  Family, 
  RemoteAddr, 
  RemotePort, 
  Pid, 
  Username
FROM netstat()
WHERE RemotePort IN (3333, 14444, 3357, 8080)
   AND Username != "root"

#!/bin/bash
# Remediation script for PAM abuse and Cryptomining removal
# Must be run as root

LOG_FILE="/var/log/pam_remediation.log"
echo "Starting PAM and Cryptominer remediation: $(date)" > $LOG_FILE

# 1. Identify and kill XMRig processes running under non-root users
echo "[+] Hunting for XMRig processes..." | tee -a $LOG_FILE
PIDS=$(pgrep -f xmrig)
if [ -n "$PIDS" ]; then
  echo "[!] Found XMRig PIDs: $PIDS" | tee -a $LOG_FILE
  for PID in $PIDS; do
    # Verify user is not root before killing (safety check)
    USER=$(ps -o user= -p $PID)
    if [ "$USER" != "root" ]; then
      echo "[+] Killing process $PID running as $USER" | tee -a $LOG_FILE
      kill -9 $PID
    fi
  done
else
  echo "[-] No XMRig processes found." | tee -a $LOG_FILE
fi

# 2. Locate and remove known malicious binaries
# Common locations where users might have write access or temp dirs
echo "[+] Scanning for malicious binaries..." | tee -a $LOG_FILE
find /tmp /var/tmp /dev/shm -name "xmrig" -exec rm -f {} \; 2>/dev/null

# 3. Audit PAM configurations for pam_exec abuse
echo "[+] Auditing /etc/pam.d/ for suspicious entries..." | tee -a $LOG_FILE
# Look for 'pam_exec.so' which is often used to launch scripts
if grep -r "pam_exec.so" /etc/pam.d/ | grep -v "^#" > /tmp/pam_audit.txt; then
  echo "[!] Potential pam_exec entries found. Review /tmp/pam_audit.txt manually." | tee -a $LOG_FILE
  # Automated restoration of backups is risky, alerting admin is preferred.
else
  echo "[-] No obvious pam_exec abuse detected." | tee -a $LOG_FILE
fi

echo "Remediation complete. Please review /var/log/pam_remediation.log and /tmp/pam_audit.txt."