KQL Search

Query Details

Crypto Miner Or Scanning Tool Execution In Kubernetes Container

Query

let Lookback = 1d;
CloudProcessEvents
| where Timestamp > ago(Lookback)
| where isnotempty(KubernetesPodName)
| extend Command = tolower(ProcessCommandLine), Proc = tolower(ProcessName)
| where Proc has_any ("xmrig", "kinsing", "masscan", "zmap", "nmap", "pnscan", "sqlmap", "zgrab")
	or Command has_any ("stratum+tcp", "minexmr", "nanopool", "moneroocean", "xmrig", "kinsing", "masscan", "zmap", "--open-only", "-p- --min-rate")
| project Timestamp, Detection="K8S miner or scanning toolkit", AzureResourceId, KubernetesNamespace, KubernetesPodName, ContainerName, ContainerImageName, AccountName, ParentProcessName, ProcessName, ProcessCommandLine, HostName

About this query

Crypto-miner or Scanning Tool Execution in Kubernetes Container

Query Information

MITRE ATT&CK Technique(s)

Technique IDTitleLink
T1559.001Active Scanning: Scanning IP Blockshttps://attack.mitre.org/techniques/T1559/001

Description

Detects the execution of known cryptocurrency miners or network scanning toolkits within a Kubernetes container. This activity often indicates unauthorized resource usage, persistence attempts, or reconnaissance within a containerized environment.

Author <Optional>

Defender XDR

Explanation

This query is designed to detect the execution of known cryptocurrency miners or network scanning tools within a Kubernetes container. It focuses on identifying unauthorized activities such as resource misuse, persistence attempts, or reconnaissance within a containerized environment. Here's a simplified breakdown of the query:

  1. Lookback Period: The query examines events from the past day (1d).

  2. Data Source: It searches through CloudProcessEvents, which contains information about processes running in cloud environments.

  3. Kubernetes Context: The query filters for events where a Kubernetes pod name is present, indicating that the process is running within a Kubernetes container.

  4. Process and Command Filtering:

    • It converts the process names and command lines to lowercase for consistent matching.
    • It checks if the process name or command line contains any known cryptocurrency mining software (like "xmrig" or "kinsing") or network scanning tools (like "masscan", "nmap", etc.).
    • It also looks for specific command line patterns associated with mining or scanning activities (e.g., "stratum+tcp", "minexmr").

  5. Output: The query projects (selects) relevant details about the detected events, such as the timestamp, detection label, Azure resource ID, Kubernetes namespace, pod name, container name, container image name, account name, parent process name, process name, process command line, and host name.

Overall, this query helps security teams identify potentially malicious activities within Kubernetes environments by flagging the execution of known mining or scanning tools.