poprhythm
ba925fe734
Detects unauthorized miners (and other runtime threats) via Falco's syscall/eBPF monitoring, following the 2026-08-06 gitea/xmrig compromise. Wired into netdata rather than a new notification channel: Falco exposes a Prometheus /metrics endpoint, netdata scrapes it, and a new health.d alarm pages through netdata's already-configured Telegram bot - no new alerting infra needed. Includes a custom process-name rule for known miner binaries (the stock Stratum-protocol rule wouldn't have caught the actual gitea incident, which used a bare host:port with no scheme prefix), an outbound miner-pool-port rule as a second layer, and rule_matching: all in the Falco config - without it, Falco silently drops all but the first matching rule per event, which would have suppressed our custom rule whenever a stock rule also matched the same process.
28 lines
1.2 KiB
YAML
28 lines
1.2 KiB
YAML
# Custom rule: catch known cryptominer binaries by process name directly.
|
|
# Added after the 2026-08-06 gitea/xmrig compromise, where the miner was
|
|
# invoked as `--url=host:port` with no "stratum+tcp" scheme prefix, which
|
|
# would NOT have matched Falco's stock "Detect crypto miners using the
|
|
# Stratum protocol" rule. Matching the binary name is the reliable signal.
|
|
|
|
- list: miner_binary_names
|
|
items: [
|
|
xmrig, xmrig-notls, xmr-stak, xmr-stak-cpu, xmr-stak-rx,
|
|
minerd, cpuminer, ccminer, cgminer, bfgminer,
|
|
nanominer, t-rex, trex, teamredminer, phoenixminer, lolminer,
|
|
ethminer, nbminer, gminer, srbminer, xmrigMiner,
|
|
]
|
|
|
|
- rule: Detect crypto miner binary execution
|
|
desc: >
|
|
A process matching a known cryptocurrency miner binary name was executed.
|
|
Catches unauthorized miners even when the command line doesn't use a
|
|
stratum+tcp:// style URL.
|
|
condition: >
|
|
spawned_process and proc.name in (miner_binary_names)
|
|
output: >
|
|
Cryptominer binary execution detected
|
|
(user=%user.name command=%proc.cmdline container=%container.name
|
|
image=%container.image.repository pid=%proc.pid)
|
|
priority: CRITICAL
|
|
tags: [miners, process, mitre_impact]
|