# Supplementary defense-in-depth: outbound connections to common mining-pool
# ports. NOTE: this image's shipped falco_rules.yaml has no built-in
# miner/stratum/pool rules to "enable" (checked directly - none exist), so
# this is written from scratch rather than overriding a stock rule. It's
# a weaker signal than miner-detect.yaml's process-name match (our actual
# incident used port 10128, which isn't in this list - pools use arbitrary
# ports), kept anyway as a second layer.

- list: miner_pool_ports
  # Kept to well-corroborated fixed mining-pool ports only, all well below
  # the Linux ephemeral port range (32768-60999). Two entries originally
  # added here without solid sourcing (45560, 45700) fell inside that
  # ephemeral range and produced an immediate false positive against
  # qbittorrent_eXoDOS's own randomly-assigned outbound source port -
  # removed.
  items: [3333, 3334, 4444, 5555, 5556, 7777, 8888, 9999, 14444]

- rule: Detect outbound connection to common miner pool port
  desc: Outbound connection to a TCP port commonly used by cryptomining pools.
  condition: >
    outbound and evt.type in (connect, sendto, sendmsg)
    and fd.rport in (miner_pool_ports)
  output: >
    Outbound connection to common miner-pool port
    (user=%user.name command=%proc.cmdline connection=%fd.name
    container=%container.name image=%container.image.repository)
  priority: WARNING
  tags: [miners, network, mitre_impact]