Rule History

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET COINMINER Possible BitCoin Miner User-Agent (miner)"; flow:established,to_server; http.user_agent; content:"miner"; nocase; content:!"IdleMiner"; content:!"CFNetwork"; pcre:"/miner[^a-z]/i"; http.host; content:!".kaspersky.com"; endswith; reference:url,abcpool.co/mining-software-comparison.php; classtype:coin-mining; sid:2016067; rev:7; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2012_12_21, deployment Perimeter, deployment Datacenter, confidence Medium, signature_severity Informational, tag Bitcoin_Miner, updated_at 2021_11_15, reviewed_at 2024_03_25;)