poprhythm
d302060e4b
Confirmed 5 false positives over 2026-08-20 to 2026-08-25, all connecting to ::1:8888 at ~21:3x daily - never a real mining-pool destination since that's loopback, and every attempt failed instantly (nothing listens on 8888). Couldn't identify the source process (falco loses metadata for it before it can be captured), but a real miner pool can never be localhost, so excluding loopback fixes the false-positive class without weakening the rule for actual remote pool connections.
38 lines
2.0 KiB
YAML
38 lines
2.0 KiB
YAML
# Supplementary defense-in-depth: outbound connections to common mining-pool
|
|
# ports. NOTE: this image's shipped falco_rules.yaml has no built-in
|
|
# miner/stratum/pool rules to "enable" (checked directly - none exist), so
|
|
# this is written from scratch rather than overriding a stock rule. It's
|
|
# a weaker signal than miner-detect.yaml's process-name match (our actual
|
|
# incident used port 10128, which isn't in this list - pools use arbitrary
|
|
# ports), kept anyway as a second layer.
|
|
|
|
- list: miner_pool_ports
|
|
# Kept to well-corroborated fixed mining-pool ports only, all well below
|
|
# the Linux ephemeral port range (32768-60999). Two entries originally
|
|
# added here without solid sourcing (45560, 45700) fell inside that
|
|
# ephemeral range and produced an immediate false positive against
|
|
# qbittorrent_eXoDOS's own randomly-assigned outbound source port -
|
|
# removed.
|
|
items: [3333, 3334, 4444, 5555, 5556, 7777, 8888, 9999, 14444]
|
|
|
|
# Loopback exclusion added 2026-08-25: some unidentified host-level process
|
|
# connects to ::1:8888 roughly once a day (confirmed 5x over 2026-08-20 to
|
|
# 2026-08-25, always ~21:3x, always container=host, always failing instantly
|
|
# since nothing listens on 8888 - falco loses process metadata for it before
|
|
# it can be identified). A real mining pool is by definition a remote
|
|
# server, so loopback destinations can never be genuine pool traffic - this
|
|
# is a false positive in the rule's design (any port 8888 connection, not
|
|
# just remote ones), not a tuned-out exception for a known process.
|
|
- rule: Detect outbound connection to common miner pool port
|
|
desc: Outbound connection to a TCP port commonly used by cryptomining pools.
|
|
condition: >
|
|
outbound and evt.type in (connect, sendto, sendmsg)
|
|
and fd.rport in (miner_pool_ports)
|
|
and not (fd.rip in ("127.0.0.1", "::1"))
|
|
output: >
|
|
Outbound connection to common miner-pool port
|
|
(user=%user.name command=%proc.cmdline connection=%fd.name
|
|
container=%container.name image=%container.image.repository)
|
|
priority: WARNING
|
|
tags: [miners, network, mitre_impact]
|