Detecting Compute Hijacking and Cryptomining (T1496.001)

T1496.001, Compute Hijacking, is the sub technique most people picture when they hear cryptojacking. It applies to Windows, IaaS, Linux, macOS and containers, and falls under impact.

How attackers use it

Adversaries use the compute of compromised systems for resource intensive work. A common purpose is to validate transactions on cryptocurrency networks and earn virtual currency. They may consume enough resources to make machines unresponsive.

Servers and cloud systems are common targets because they offer a lot of capacity, though endpoints can be used too. MITRE notes containerized environments may be targeted because of the ease of deployment through exposed APIs and the chance to scale mining by deploying or compromising many containers in a cluster. Some mining malware also finds and kills competing malware to keep the resources for itself.

MITRE's examples include a Monero mining tool deployed in a victim environment, use of XMRig on victim systems, and a loader that can deploy follow on mining payloads.

How to detect it

MITRE describes five analytics.

• Windows: long running, heavy CPU processes started by scheduled tasks, WMI or PowerShell that keep outbound connections open and often disguise or rename binaries.
• Linux: long running, high CPU processes launched from cron, shell scripts or Docker, especially connecting to known mining pools or using DNS over HTTPS to hide traffic.
• macOS: persistence through launchd or plist jobs that spawn miners such as xmrig or cpuminer, with encrypted outbound traffic to mining proxies.
• Containers: containers started from public images that quickly spike CPU use, often deployed through Kubernetes or by abusing the Docker socket.
• Cloud: instances created in regions the organization does not monitor or use, or sudden bursts of compute heavy work on spot instances or existing VMs.

MITRE does not name log sources. The analytics imply process execution, network connection, container and orchestration data, and cloud instance activity.

How to reduce the risk

MITRE says this technique is hard to address with preventive controls because it abuses legitimate system features. Reduce the ways in:

1. Do not expose container or orchestration APIs to the internet, and lock down the Docker socket.
2. Limit who can create instances, and restrict unused regions.
3. Set CPU and memory limits on containers.
4. Review base images and dependencies before you deploy them. Public images and third party packages are a normal way for unwanted code to arrive.
5. Alert on sustained CPU use outside normal patterns.

Click through it at your own pace, or open it full screen.

Check your own environment

You can check a project's dependencies in your browser at https://gold.safeguard.sh/scan. No login is needed, the file never leaves your machine, and it takes up to 100 dependencies.

These read-only checks apply on a Linux host.

# Top CPU consumers right now
ps aux --sort=-%cpu | head -n 10

# Outbound established connections with owning process (needs root to see all)
ss -tnp state established

Then review cron entries and systemd timers for anything you do not recognize.

Quick check

Sources

• MITRE ATT&CK T1496.001: Compute Hijacking