Crypto Miner Or Scanning Tool Execution In Kubernetes Container
Query
let Lookback = 1d;
CloudProcessEvents
| where Timestamp > ago(Lookback)
| where isnotempty(KubernetesPodName)
| extend Command = tolower(ProcessCommandLine), Proc = tolower(ProcessName)
| where Proc has_any ("xmrig", "kinsing", "masscan", "zmap", "nmap", "pnscan", "sqlmap", "zgrab")
or Command has_any ("stratum+tcp", "minexmr", "nanopool", "moneroocean", "xmrig", "kinsing", "masscan", "zmap", "--open-only", "-p- --min-rate")
| project Timestamp, Detection="K8S miner or scanning toolkit", AzureResourceId, KubernetesNamespace, KubernetesPodName, ContainerName, ContainerImageName, AccountName, ParentProcessName, ProcessName, ProcessCommandLine, HostNameAbout this query
Crypto-miner or Scanning Tool Execution in Kubernetes Container
Query Information
MITRE ATT&CK Technique(s)
| Technique ID | Title | Link |
|---|---|---|
| T1496 | Ressource Hijacking | https://attack.mitre.org/techniques/T1496 |
| T1595.001 | Active Scanning: Scanning IP Blocks | https://attack.mitre.org/techniques/T1559/001 |
Description
Detects the execution of known cryptocurrency miners or network scanning toolkits within a Kubernetes container. This activity often indicates unauthorized resource usage, persistence attempts, or reconnaissance within a containerized environment.
Author <Optional>
- Name: Benjamin Zulliger
- Github: https://github.com/benscha/KQLAdvancedHunting
- LinkedIn: https://www.linkedin.com/in/benjamin-zulliger/
Defender XDR
Explanation
This query is designed to detect the execution of known cryptocurrency mining software or network scanning tools within a Kubernetes container environment. Here's a simplified breakdown of what the query does:
-
Time Frame: It looks at cloud process events from the last day (
Lookback = 1d). -
Kubernetes Context: It specifically focuses on events where a Kubernetes pod name is present, indicating activity within a Kubernetes container.
-
Command and Process Filtering:
- It converts the process command line and process name to lowercase for consistent comparison.
- It checks if the process name or command line contains any known cryptocurrency miners (like "xmrig", "kinsing") or network scanning tools (like "masscan", "nmap").
- It also looks for specific command line patterns associated with these activities (like "stratum+tcp" for mining or "--open-only" for scanning).
-
Output: If any such activity is detected, it outputs relevant details including the timestamp, detection type, Azure resource ID, Kubernetes namespace, pod name, container name, container image name, account name, parent process name, process name, process command line, and host name.
Overall, this query helps identify unauthorized or suspicious activities that could indicate resource hijacking or reconnaissance efforts within a Kubernetes environment.