alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED CoinMiner Known Malicious Stratum Authline (2022-03-11 2)"; flow:established,to_server; content:"|22|id|22 3A|"; content:"|22|method|22 3a|"; pcre:"/(?:\x22mining\.authorize\x22\x2c|\x22login\x22\x2c)/R"; content:"|22|params|22|"; within:50; pcre:"/(?:\x22login\x22\x3a\x226243128\x22\x2c\x22pass\x22\x3a\x22myminer\x22|\x22login\x22\x3a\x226249832\x22\x2c\x22pass\x22\x3a\x22viristotal\x22|\x22login\x22\x3a\x226250474\x22\x2c\x22pass\x22\x3a\x22Minecraft\x22|\x22login\x22\x3a\x2244z5DkTXSYBfYECbt5TdQ2SUpyAQJmmGubyUsWqzcByeKwxwsWSZabZQMuE39hedNcTL15eK8kHrAeZMUdGGmHQHBzNH5db\x22\x2c\x22pass\x22\x3a\x22bomba3\x22|\x22login\x22\x3a\x2247WpQT7o5YMPeUjZ2AYqo2HNu9SnfQ3Le5MywXMgCuBS1DHqMTQFNY7MCsWkr466gQNC5G182ZCCDiKs69mwdvr4EjvhT5c\x22\x2c\x22pass\x22\x3a\x22Krutish\x22)/R"; reference:md5,63c361252b50f6099ef962a554501257; reference:url,www.btcguild.com/new_protocol.php; reference:url,research.zscaler.com/2013/12/bitcoin-mining-operation-seen-across.html; reference:url,mining.bitcoin.cz/stratum-mining; classtype:coin-mining; sid:2035436; rev:3; metadata:attack_target Client_Endpoint, created_at 2022_03_11, deployment Perimeter, confidence High, signature_severity Major, tag Coinminer, updated_at 2023_04_09, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1496, mitre_technique_name Resource_Hijacking;)