poprhythm
ba925fe734
Detects unauthorized miners (and other runtime threats) via Falco's syscall/eBPF monitoring, following the 2026-08-06 gitea/xmrig compromise. Wired into netdata rather than a new notification channel: Falco exposes a Prometheus /metrics endpoint, netdata scrapes it, and a new health.d alarm pages through netdata's already-configured Telegram bot - no new alerting infra needed. Includes a custom process-name rule for known miner binaries (the stock Stratum-protocol rule wouldn't have caught the actual gitea incident, which used a bare host:port with no scheme prefix), an outbound miner-pool-port rule as a second layer, and rule_matching: all in the Falco config - without it, Falco silently drops all but the first matching rule per event, which would have suppressed our custom rule whenever a stock rule also matched the same process.
29 lines
1.4 KiB
YAML
29 lines
1.4 KiB
YAML
# Supplementary defense-in-depth: outbound connections to common mining-pool
|
|
# ports. NOTE: this image's shipped falco_rules.yaml has no built-in
|
|
# miner/stratum/pool rules to "enable" (checked directly - none exist), so
|
|
# this is written from scratch rather than overriding a stock rule. It's
|
|
# a weaker signal than miner-detect.yaml's process-name match (our actual
|
|
# incident used port 10128, which isn't in this list - pools use arbitrary
|
|
# ports), kept anyway as a second layer.
|
|
|
|
- list: miner_pool_ports
|
|
# Kept to well-corroborated fixed mining-pool ports only, all well below
|
|
# the Linux ephemeral port range (32768-60999). Two entries originally
|
|
# added here without solid sourcing (45560, 45700) fell inside that
|
|
# ephemeral range and produced an immediate false positive against
|
|
# qbittorrent_eXoDOS's own randomly-assigned outbound source port -
|
|
# removed.
|
|
items: [3333, 3334, 4444, 5555, 5556, 7777, 8888, 9999, 14444]
|
|
|
|
- rule: Detect outbound connection to common miner pool port
|
|
desc: Outbound connection to a TCP port commonly used by cryptomining pools.
|
|
condition: >
|
|
outbound and evt.type in (connect, sendto, sendmsg)
|
|
and fd.rport in (miner_pool_ports)
|
|
output: >
|
|
Outbound connection to common miner-pool port
|
|
(user=%user.name command=%proc.cmdline connection=%fd.name
|
|
container=%container.name image=%container.image.repository)
|
|
priority: WARNING
|
|
tags: [miners, network, mitre_impact]
|