Install this skill

npx skills add mukul975/Anthropic-Cybersecurity-Skills

Framework mappings

MITRE ATT&CK

NIST CSF 2.0

When to Use

When cloud billing alerts indicate unexpected compute cost spikes
When GuardDuty generates CryptoCurrency or Impact finding types
When investigating compromised IAM credentials that may be used to launch mining instances
When monitoring container workloads for unauthorized process execution
When establishing proactive detection controls against resource hijacking attacks

Do not use for legitimate cryptocurrency mining operations, for non-cloud mining detection on physical hardware, or for general malware analysis unrelated to mining activity.

Prerequisites

Amazon GuardDuty enabled with Runtime Monitoring for EC2, ECS, and EKS
CloudWatch or Azure Monitor configured for compute utilization alerting
VPC Flow Logs enabled for network traffic analysis to mining pool IPs
AWS Cost Anomaly Detection or Azure Cost Management alerts configured

Workflow

Step 1: Establish Detection Through Multiple Signals

Deploy detection across four signal categories: cost anomalies, compute utilization, network traffic, and runtime processes.

# AWS Cost Anomaly Detection
aws ce create-anomaly-monitor \
  --anomaly-monitor '{
    "MonitorName": "EC2CostSpike",
    "MonitorType": "DIMENSIONAL",
    "MonitorDimension": "SERVICE"
  }'
 
aws ce create-anomaly-subscription \
  --anomaly-subscription '{
    "SubscriptionName": "CryptoMiningAlert",
    "MonitorArnList": ["arn:aws:ce::123456789012:anomalymonitor/monitor-id"],
    "Subscribers": [{"Address": "security@company.com", "Type": "EMAIL"}],
    "Threshold": 50.0,
    "Frequency": "IMMEDIATE"
  }'
 
# CloudWatch alarm for CPU utilization spike
aws cloudwatch put-metric-alarm \
  --alarm-name HighCPUUtilization \
  --namespace AWS/EC2 \
  --metric-name CPUUtilization \
  --statistic Average \
  --period 300 \
  --threshold 90 \
  --comparison-operator GreaterThanThreshold \
  --evaluation-periods 3 \
  --alarm-actions "arn:aws:sns:us-east-1:123456789012:security-alerts"

Step 2: Monitor GuardDuty CryptoCurrency Findings

Configure alerting for GuardDuty findings specific to cryptocurrency mining activity on EC2, ECS, and EKS workloads.

Key GuardDuty finding types for cryptomining:

CryptoCurrency:EC2/BitcoinTool.B - Network connections to crypto-related domains
CryptoCurrency:Runtime/BitcoinTool.B - Runtime detection of mining process execution
Impact:EC2/BitcoinTool.B - EC2 instance communicating with known Bitcoin mining pools
Impact:Runtime/CryptoMinerExecuted - Crypto mining binary execution detected by runtime agent

# EventBridge rule for cryptocurrency findings
aws events put-rule \
  --name CryptoMiningDetection \
  --event-pattern '{
    "source": ["aws.guardduty"],
    "detail-type": ["GuardDuty Finding"],
    "detail": {
      "type": [
        {"prefix": "CryptoCurrency:"},
        {"prefix": "Impact:EC2/BitcoinTool"},
        {"prefix": "Impact:Runtime/CryptoMiner"}
      ]
    }
  }'
 
# Auto-remediation Lambda for crypto findings
aws events put-targets \
  --rule CryptoMiningDetection \
  --targets '[{
    "Id": "CryptoAutoRemediate",
    "Arn": "arn:aws:lambda:us-east-1:123456789012:function/crypto-remediate"
  }]'

Step 3: Analyze Network Traffic for Mining Pool Connections

Monitor VPC Flow Logs and DNS queries for connections to known cryptocurrency mining pools operating on common ports (3333, 4444, 5555, 8333, 9999, 14444).

// Sentinel KQL query for mining pool connections
AzureNetworkAnalytics_CL
| where TimeGenerated > ago(24h)
| where DestPort_d in (3333, 4444, 5555, 8333, 9999, 14444, 14433, 45700)
| summarize ConnectionCount = count(), BytesSent = sum(BytesSent_d)
            by SrcIP_s, DestIP_s, DestPort_d, bin(TimeGenerated, 1h)
| where ConnectionCount > 10
| project TimeGenerated, SrcIP_s, DestIP_s, DestPort_d, ConnectionCount, BytesSent

# AWS Athena query for VPC Flow Logs mining pool detection
cat << 'EOF' > mining-detection.sql
SELECT srcaddr, dstaddr, dstport, protocol,
       COUNT(*) as connection_count,
       SUM(bytes) as total_bytes
FROM vpc_flow_logs
WHERE dstport IN (3333, 4444, 5555, 8333, 9999, 14444)
  AND action = 'ACCEPT'
  AND start >= date_add('hour', -24, now())
GROUP BY srcaddr, dstaddr, dstport, protocol
HAVING COUNT(*) > 10
ORDER BY connection_count DESC
EOF

Step 4: Detect Mining in Container Environments

Monitor ECS task definitions and EKS pod deployments for known mining container images and suspicious process execution.

# Check for recently registered ECS task definitions with suspicious images
aws ecs list-task-definitions --sort DESC --max-items 50 | \
  jq -r '.taskDefinitionArns[]' | while read arn; do
    aws ecs describe-task-definition --task-definition "$arn" \
      --query 'taskDefinition.containerDefinitions[*].[name,image]' --output text
  done
 
# Known malicious mining images to watch for:
# - Images with high pull counts from unknown registries
# - Images containing xmrig, cpuminer, minergate, or ccminer binaries
# - Images with entrypoint pointing to /tmp/.hidden or /dev/shm paths
 
# Monitor CloudTrail for suspicious ECS/EKS activity
aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=EventName,AttributeValue=RegisterTaskDefinition \
  --start-time $(date -d '-24 hours' +%Y-%m-%dT%H:%M:%S) \
  --query 'Events[*].[EventName,Username,EventTime]'

Step 5: Respond and Contain Mining Activity

Execute immediate containment actions when mining is confirmed, preserving forensic evidence before terminating the malicious workloads.

# Auto-remediation Lambda for cryptomining incidents
import boto3
import json
 
def lambda_handler(event, context):
    finding = event['detail']
    resource_type = finding['resource']['resourceType']
 
    if resource_type == 'Instance':
        instance_id = finding['resource']['instanceDetails']['instanceId']
        ec2 = boto3.client('ec2')
 
        # Snapshot EBS volumes for forensics before isolation
        volumes = ec2.describe_instances(InstanceIds=[instance_id])
        for reservation in volumes['Reservations']:
            for instance in reservation['Instances']:
                for vol in instance['BlockDeviceMappings']:
                    volume_id = vol['Ebs']['VolumeId']
                    ec2.create_snapshot(
                        VolumeId=volume_id,
                        Description=f'Forensic snapshot - crypto mining - {instance_id}',
                        TagSpecifications=[{
                            'ResourceType': 'snapshot',
                            'Tags': [{'Key': 'Incident', 'Value': 'CryptoMining'},
                                     {'Key': 'SourceInstance', 'Value': instance_id}]
                        }]
                    )
 
        # Disable API termination protection if set by attacker
        ec2.modify_instance_attribute(
            InstanceId=instance_id,
            DisableApiTermination={'Value': False}
        )
 
        # Isolate instance with empty security group
        vpc_id = finding['resource']['instanceDetails']['networkInterfaces'][0]['vpcId']
        isolation_sg = ec2.create_security_group(
            GroupName=f'crypto-isolation-{instance_id}',
            Description='Cryptomining isolation - no traffic allowed',
            VpcId=vpc_id
        )
        # Revoke default egress rule
        ec2.revoke_security_group_egress(
            GroupId=isolation_sg['GroupId'],
            IpPermissions=[{'IpProtocol': '-1', 'IpRanges': [{'CidrIp': '0.0.0.0/0'}]}]
        )
        ec2.modify_instance_attribute(
            InstanceId=instance_id,
            Groups=[isolation_sg['GroupId']]
        )
 
        return {'status': 'contained', 'instance': instance_id}

Step 6: Trace Initial Access Vector

Investigate CloudTrail logs to determine how the attacker gained access to deploy mining workloads. Common vectors include compromised IAM credentials, exposed access keys, and supply chain attacks through container images.

# Trace the initial access for the compromised identity
aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=Username,AttributeValue=compromised-user \
  --start-time 2025-02-01T00:00:00Z \
  --query 'Events[?EventName==`ConsoleLogin` || EventName==`GetSessionToken`].[EventTime,SourceIPAddress,EventName]' \
  --output table
 
# Check for RunInstances calls in unusual regions
for region in $(aws ec2 describe-regions --query 'Regions[*].RegionName' --output text); do
  count=$(aws cloudtrail lookup-events \
    --region $region \
    --lookup-attributes AttributeKey=EventName,AttributeValue=RunInstances \
    --start-time $(date -d '-7 days' +%Y-%m-%dT%H:%M:%S) \
    --query 'Events | length(@)')
  if [ "$count" -gt 0 ]; then
    echo "Region: $region - RunInstances calls: $count"
  fi
done

Key Concepts

Term	Definition
Cryptojacking	Unauthorized use of cloud compute resources to mine cryptocurrency, typically Monero (XMR) due to its CPU-friendly algorithm
Stratum Protocol	Mining pool communication protocol operating on TCP ports 3333, 4444, or custom ports, identifiable in network flow logs
XMRig	Open-source Monero mining software commonly found in cryptojacking attacks, often deployed as a hidden binary in containers
API Termination Protection	EC2 attribute that attackers enable to prevent security teams from quickly terminating compromised mining instances
Cost Anomaly Detection	AWS service that uses machine learning to identify unusual spending patterns that may indicate unauthorized resource usage
Runtime Monitoring	GuardDuty capability that deploys agents to detect process-level activity including crypto mining binary execution
Attack Sequence	GuardDuty Extended Threat Detection finding correlating credential theft, infrastructure deployment, and mining execution into a single Critical event

Tools & Systems

Amazon GuardDuty: Detects cryptocurrency mining through network traffic analysis, DNS queries, and runtime process monitoring
AWS Cost Anomaly Detection: Machine learning-based service identifying unexpected cost increases from mining instance deployment
VPC Flow Logs: Network traffic metadata showing connections to mining pool IP addresses and ports
Falco: Open-source runtime security tool for detecting crypto mining process execution in containers
Amazon Detective: Graph-based investigation tool for tracing the attack path from initial access to mining deployment

Common Scenarios

Scenario: Compromised IAM Credentials Used for Large-Scale EC2 Mining

Context: Exposed IAM credentials from a public GitHub repository are used to launch 200 GPU instances across 8 AWS regions within 10 minutes. The attacker enables API termination protection and disables CloudTrail in each region.

Approach:

AWS Cost Anomaly Detection triggers an immediate alert for $15,000+ hourly EC2 spend
GuardDuty generates Stealth:IAMUser/CloudTrailLoggingDisabled and CryptoCurrency:EC2/BitcoinTool.B findings
Immediately deactivate the compromised IAM access key
Re-enable CloudTrail in all affected regions to restore visibility
Disable API termination protection on all 200 instances and terminate them
Create forensic snapshots of representative instances before termination
Review the GitHub commit history to identify and remove the exposed credentials
Deploy AWS Config rules preventing CloudTrail disabling and enforcing IMDSv2

Pitfalls: Failing to check all AWS regions for mining instances leaves active miners running in overlooked regions. Not disabling API termination protection before attempting to stop instances wastes response time.

Output Format

Cryptomining Incident Response Report
=======================================
Incident ID: INC-2025-0223-CRYPTO
Detection Time: 2025-02-23T14:23:00Z
Containment Time: 2025-02-23T14:41:00Z (18 minutes)
 
INITIAL ACCESS:
  Vector: Exposed IAM access key in public GitHub repository
  Credential: AKIAIOSFODNN7EXAMPLE (user: ci-deploy)
  First Malicious Activity: 2025-02-23T14:12:00Z
 
IMPACT:
  Instances Launched: 200 (p3.2xlarge GPU instances)
  Regions Affected: 8 (us-east-1, us-west-2, eu-west-1, eu-central-1, ...)
  Estimated Cost: $4,200 (18 minutes at $15,400/hour)
  Mining Pool: stratum+tcp://pool.supportxmr.com:3333
  Cryptocurrency: Monero (XMR)
 
DETECTION SIGNALS:
  [14:15] GuardDuty: Stealth:IAMUser/CloudTrailLoggingDisabled (HIGH)
  [14:18] Cost Anomaly: EC2 spend 4,200% above baseline
  [14:23] GuardDuty: CryptoCurrency:EC2/BitcoinTool.B (HIGH) x 200
 
CONTAINMENT ACTIONS:
  [14:25] IAM access key AKIAIOSFODNN7EXAMPLE deactivated
  [14:30] CloudTrail re-enabled in all 8 regions
  [14:35] API termination protection disabled on 200 instances
  [14:41] All 200 instances terminated
 
REMEDIATION:
  - Compromised access key deleted
  - GitHub repository secret scanning enabled
  - AWS Config rule deployed: cloudtrail-enabled (auto-remediate)
  - SCP deployed: deny ec2:RunInstances for GPU instance types without approval

Source materials

References and resources

Everything below is rendered for inspection. Script files are read-only and never run.

References 1

api-reference.md2.1 KB

Detecting Cryptomining in Cloud API Reference

Detection Signal Categories

Signal	Source	Indicator
Cost spike	AWS Cost Explorer	Sudden EC2/GPU cost increase
High CPU	CloudWatch	Sustained >95% CPU utilization
Mining ports	VPC Flow Logs	Traffic on 3333, 4444, 14444
DNS queries	GuardDuty / Route53	Queries to pool domains
Process	Runtime Monitoring	xmrig, ccminer, ethminer

GuardDuty Crypto Findings

# List crypto findings
aws guardduty list-findings --detector-id $DET \
  --finding-criteria '{"Criterion":{"type":{"Eq":["CryptoCurrency:EC2/BitcoinTool.B!DNS","CryptoCurrency:Runtime/BitcoinTool.B"]}}}'

CloudWatch CPU Alarm

aws cloudwatch put-metric-alarm \
  --alarm-name "HighCPU-Mining" \
  --metric-name CPUUtilization \
  --namespace AWS/EC2 \
  --statistic Average \
  --period 300 --threshold 95 \
  --comparison-operator GreaterThanThreshold \
  --evaluation-periods 6 \
  --alarm-actions arn:aws:sns:us-east-1:123456:SOCAlerts

AWS Cost Anomaly Detection

# Create monitor
aws ce create-anomaly-monitor --anomaly-monitor '{
  "MonitorName": "EC2CostSpike", "MonitorType": "DIMENSIONAL",
  "MonitorDimension": "SERVICE"
}'
 
# Get anomalies
aws ce get-anomalies --date-interval '{"StartDate":"2024-01-01","EndDate":"2024-01-31"}'

VPC Flow Logs Mining Port Query

fields @timestamp, srcaddr, dstaddr, dstport, bytes
| filter dstport in [3333, 4444, 5555, 14444, 45700]
| stats sum(bytes) as total_bytes by srcaddr, dstaddr, dstport
| sort total_bytes desc

Known Mining Pool Domains

pool.minexmr.com, xmr.pool.minergate.com, monerohash.com,
xmrpool.eu, supportxmr.com, pool.hashvault.pro,
gulf.moneroocean.stream, rx.unmineable.com

Instance Remediation

# Terminate mining instance
aws ec2 terminate-instances --instance-ids i-0123456789abcdef0
 
# Isolate via security group
aws ec2 modify-instance-attribute --instance-id i-xxx --groups sg-isolation
 
# Snapshot for forensics before termination
aws ec2 create-snapshot --volume-id vol-xxx --description "Mining forensics"

Scripts 1

agent.py6.5 KB

Display-only source. This catalog never executes bundled scripts.

#!/usr/bin/env python3
"""Cloud cryptomining detection agent with multi-signal analysis."""

import json
import subprocess
import sys
from datetime import datetime, timedelta


MINING_PORTS = [3333, 4444, 5555, 7777, 8888, 9999, 14444, 14433, 45700]
MINING_DOMAINS = [
    "pool.minexmr.com", "xmr.pool.minergate.com", "monerohash.com",
    "xmrpool.eu", "supportxmr.com", "pool.hashvault.pro",
    "gulf.moneroocean.stream", "rx.unmineable.com",
]


def aws_cli(args):
    """Execute AWS CLI command and return parsed JSON."""
    cmd = ["aws"] + args + ["--output", "json"]
    try:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=30)
        if result.returncode == 0 and result.stdout.strip():
            return json.loads(result.stdout)
        return {"error": result.stderr.strip()} if result.returncode != 0 else {}
    except Exception as e:
        return {"error": str(e)}


def get_guardduty_crypto_findings():
    """Retrieve GuardDuty cryptocurrency-related findings."""
    det = aws_cli(["guardduty", "list-detectors"])
    detector_id = det.get("DetectorIds", [None])[0]
    if not detector_id:
        return {"error": "No GuardDuty detector found"}

    crypto_types = [
        "CryptoCurrency:EC2/BitcoinTool.B!DNS",
        "CryptoCurrency:EC2/BitcoinTool.B",
        "CryptoCurrency:Runtime/BitcoinTool.B!DNS",
        "CryptoCurrency:Runtime/BitcoinTool.B",
        "Impact:EC2/BitcoinDomainRequest.Reputation",
    ]
    result = aws_cli([
        "guardduty", "list-findings",
        "--detector-id", detector_id,
        "--finding-criteria", json.dumps({"Criterion": {"type": {"Eq": crypto_types}}}),
    ])
    finding_ids = result.get("FindingIds", [])
    if not finding_ids:
        return {"count": 0, "findings": []}

    details = aws_cli(["guardduty", "get-findings", "--detector-id", detector_id, "--finding-ids"] + finding_ids[:20])
    parsed = []
    for f in details.get("Findings", []):
        inst = f.get("Resource", {}).get("InstanceDetails", {})
        parsed.append({
            "type": f.get("Type"),
            "severity": f.get("Severity"),
            "instance_id": inst.get("InstanceId"),
            "instance_type": inst.get("InstanceType"),
            "region": f.get("Region"),
        })
    return {"count": len(parsed), "findings": parsed}


def check_high_cpu_instances():
    """Find EC2 instances with sustained high CPU utilization."""
    instances = aws_cli(["ec2", "describe-instances",
                         "--filters", "Name=instance-state-name,Values=running",
                         "--query", "Reservations[*].Instances[*].[InstanceId,InstanceType,LaunchTime]",
                         "--output", "json"])
    return instances


def create_cost_anomaly_monitor():
    """Create AWS Cost Anomaly Detection monitor for EC2 spikes."""
    return aws_cli([
        "ce", "create-anomaly-monitor",
        "--anomaly-monitor", json.dumps({
            "MonitorName": "CryptoMiningCostSpike",
            "MonitorType": "DIMENSIONAL",
            "MonitorDimension": "SERVICE",
        }),
    ])


def check_cloudtrail_instance_launches(hours=24):
    """Check CloudTrail for unusual instance launch patterns."""
    end_time = datetime.utcnow()
    start_time = end_time - timedelta(hours=hours)
    result = aws_cli([
        "cloudtrail", "lookup-events",
        "--lookup-attributes", json.dumps([
            {"AttributeKey": "EventName", "AttributeValue": "RunInstances"}
        ]),
        "--start-time", start_time.isoformat() + "Z",
        "--end-time", end_time.isoformat() + "Z",
        "--max-results", "50",
    ])
    events = []
    for e in result.get("Events", []):
        detail = json.loads(e.get("CloudTrailEvent", "{}"))
        events.append({
            "time": e.get("EventTime"),
            "user": e.get("Username"),
            "source_ip": detail.get("sourceIPAddress"),
            "region": detail.get("awsRegion"),
            "instance_type": detail.get("requestParameters", {}).get("instanceType"),
        })
    return {"launches": events, "count": len(events)}


def query_vpc_flow_logs_mining(log_group="/aws/vpc/flowlogs"):
    """Query VPC Flow Logs for traffic to mining pool ports."""
    port_filter = " || ".join([f"dstport = {p}" for p in MINING_PORTS])
    query = f"""
    fields @timestamp, srcaddr, dstaddr, dstport, bytes, action
    | filter ({port_filter})
    | sort @timestamp desc
    | limit 100
    """
    return aws_cli([
        "logs", "start-query",
        "--log-group-name", log_group,
        "--start-time", str(int((datetime.utcnow() - timedelta(hours=24)).timestamp())),
        "--end-time", str(int(datetime.utcnow().timestamp())),
        "--query-string", query,
    ])


def isolate_mining_instance(instance_id):
    """Isolate a mining instance by modifying its security group."""
    sg_result = aws_cli([
        "ec2", "create-security-group",
        "--group-name", f"isolation-{instance_id}",
        "--description", "Isolation SG for mining instance",
    ])
    sg_id = sg_result.get("GroupId")
    if not sg_id:
        return {"error": "Failed to create isolation security group"}

    return aws_cli([
        "ec2", "modify-instance-attribute",
        "--instance-id", instance_id,
        "--groups", sg_id,
    ])


def generate_report():
    """Generate comprehensive cryptomining detection report."""
    return {
        "timestamp": datetime.utcnow().isoformat() + "Z",
        "guardduty": get_guardduty_crypto_findings(),
        "recent_launches": check_cloudtrail_instance_launches(),
        "known_mining_ports": MINING_PORTS,
        "known_mining_domains": MINING_DOMAINS,
    }


if __name__ == "__main__":
    action = sys.argv[1] if len(sys.argv) > 1 else "report"
    if action == "report":
        print(json.dumps(generate_report(), indent=2, default=str))
    elif action == "findings":
        print(json.dumps(get_guardduty_crypto_findings(), indent=2, default=str))
    elif action == "launches":
        hours = int(sys.argv[2]) if len(sys.argv) > 2 else 24
        print(json.dumps(check_cloudtrail_instance_launches(hours), indent=2, default=str))
    elif action == "flow-logs":
        lg = sys.argv[2] if len(sys.argv) > 2 else "/aws/vpc/flowlogs"
        print(json.dumps(query_vpc_flow_logs_mining(lg), indent=2, default=str))
    elif action == "isolate" and len(sys.argv) > 2:
        print(json.dumps(isolate_mining_instance(sys.argv[2]), indent=2))
    else:
        print("Usage: agent.py [report|findings|launches [hours]|flow-logs [log-group]|isolate <instance-id>]")

Keep exploring