alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED CoinMiner Known Malicious Stratum Authline (2022-03-11 1)"; flow:established,to_server; content:"|22|id|22 3A|"; content:"|22|method|22 3a|"; pcre:"/(?:\x22mining\.authorize\x22\x2c|\x22login\x22\x2c)/R"; content:"|22|params|22|"; within:50; pcre:"/(?:\x22login\x22\x3a\x22x\.0929c\x22\x2c\x22pass\x22\x3a\x22x\x22|\x22login\x22\x3a\x2282ZEhnLaX3ggrz5HbJJyinFjt8JyLomMnXYctMHJZCg368RrSyjQgN3TgrfbjqjUVdBPTP5VgEBkBYEWnTVHUgtjPweS5gc\x22\x2c\x22pass\x22\x3a\x22\x22|\x22login\x22\x3a\x224GdoN7NCTi8a5gZug7PrwZNKjvHFmKeV11L6pNJPgj5QNEHsN6eeX3DaAQFwZ1ufD4LYCZKArktt113W7QjWvQ7CW864Ah1Quz41mP4MJy\x22\x2c\x22pass\x22\x3a\x22x\x22|\x22login\x22\x3a\x2249GB8ucxW13fM78PMN2X3ZDYunniTj3pfdoyjztCkjDZQLSxRuZARgKEsfMDtoGGuiGGxWqeh6uez8mxYsPfm8TEGFq48Ce\x22\x2c\x22pass\x22\x3a\x22SynopsisX\x22|\x22login\x22\x3a\x22tyrenke\x22\x2c\x22pass\x22\x3a\x22tyrenke\x22)/R"; reference:md5,5c8ccae9c6841583a026c8276992045f; reference:url,www.btcguild.com/new_protocol.php; reference:url,research.zscaler.com/2013/12/bitcoin-mining-operation-seen-across.html; reference:url,mining.bitcoin.cz/stratum-mining; classtype:coin-mining; sid:2035435; rev:3; metadata:attack_target Client_Endpoint, created_at 2022_03_11, deployment Perimeter, confidence High, signature_severity Major, tag Coinminer, updated_at 2023_04_09, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1496, mitre_technique_name Resource_Hijacking;)