r_m_crowdstrike_falcon_Cryptomining.md

Rules by Product and UseCase

Vendor: CrowdStrike

Product: Falcon

Use-Case: Cryptomining

Rules	Models	MITRE ATT&CK® TTPs	Activity Types	Parsers
2	0	1	2	6

Event Type	Rules	Models
network-connection-successful	T1496 - Resource Hijacking ↳ A-NET-Coin-IP: Connection to IP associated with cryptocurrency mining
process-created	T1496 - Resource Hijacking ↳ A-EPA-Shadow-Mining-name: Process ending with 'miner.exe' has been run on this asset