DocsAttack Types

Cryptomining

Communication with cryptocurrency mining pools.

A VM mines cryptocurrency, often after being compromised, using CPU and talking to mining pools. Frabs matches pool destinations and mining protocols and can block the pool.

Detectors (7)

Detector	Measures	Warning	Incident	Critical
Mining Pool Communication	Contacts with addresses on threat-intelligence lists (contacts)	1 in 10 min	10 in 1 h	100 in 1 h
Stratum Mining	Connections speaking the Stratum mining protocol (connections)	1 in 10 min	3 in 30 min	5 in 1 h
Stratum V1 Traffic	Connections speaking the Stratum mining protocol (connections)	1 in 10 min	3 in 30 min	5 in 1 h
Stratum V2 Traffic	Connections speaking the Stratum mining protocol (connections)	1 in 10 min	3 in 30 min	5 in 1 h
Mining Proxy Communication	Contacts with addresses on threat-intelligence lists (contacts)	1 in 10 min	10 in 1 h	100 in 1 h
Cryptocurrency Pool Discovery	Contacts with addresses on threat-intelligence lists (contacts)	1 in 10 min	10 in 1 h	100 in 1 h
Known Mining Destination	Contacts with addresses on threat-intelligence lists (contacts)	1 in 10 min	10 in 1 h	100 in 1 h

Change the thresholds

Use Custom Protection to change any of these, or set them for one VM. See Detectors and Thresholds.

PreviousRemote-Service Abuse NextData Exfiltration & Suspicious Transfers