# Supplementary defense-in-depth: outbound connections to common mining-pool
# ports. NOTE: this image's shipped falco_rules.yaml has no built-in
# miner/stratum/pool rules to "enable" (checked directly - none exist), so
# this is written from scratch rather than overriding a stock rule. It's
# a weaker signal than miner-detect.yaml's process-name match (our actual
# incident used port 10128, which isn't in this list - pools use arbitrary
# ports), kept anyway as a second layer.

- list: miner_pool_ports
  # Kept to well-corroborated fixed mining-pool ports only, all well below
  # the Linux ephemeral port range (32768-60999). Two entries originally
  # added here without solid sourcing (45560, 45700) fell inside that
  # ephemeral range and produced an immediate false positive against
  # qbittorrent_eXoDOS's own randomly-assigned outbound source port -
  # removed.
  items: [3333, 3334, 4444, 5555, 5556, 7777, 8888, 9999, 14444]

# Loopback exclusion added 2026-08-25: some unidentified host-level process
# connects to ::1:8888 roughly once a day (confirmed 5x over 2026-08-20 to
# 2026-08-25, always ~21:3x, always container=host, always failing instantly
# since nothing listens on 8888 - falco loses process metadata for it before
# it can be identified). A real mining pool is by definition a remote
# server, so loopback destinations can never be genuine pool traffic - this
# is a false positive in the rule's design (any port 8888 connection, not
# just remote ones), not a tuned-out exception for a known process.
- rule: Detect outbound connection to common miner pool port
  desc: Outbound connection to a TCP port commonly used by cryptomining pools.
  condition: >
    outbound and evt.type in (connect, sendto, sendmsg)
    and fd.rport in (miner_pool_ports)
    and not (fd.rip in ("127.0.0.1", "::1"))
  output: >
    Outbound connection to common miner-pool port
    (user=%user.name command=%proc.cmdline connection=%fd.name
    container=%container.name image=%container.image.repository)
  priority: WARNING
  tags: [miners, network, mitre_impact]