[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AEBKDX0QFXTRRE4Z9P3F66":3,"skill-same:01M6AEBKDX0QFXTRRE4Z9P3F66":129},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":26,"publishedAt":47,"linkOnly":48,"markdownContent":49,"markdownBody":50,"frontMatter":51,"refName":88,"commitSha":89,"skillDirectory":90,"forksCount":91,"repositoryHtmlUrl":92,"repositoryHomepageUrl":93,"ownerHtmlUrl":94,"ownerBlogUrl":95,"ownerDescription":96,"updatedAt":97,"install":98,"resources":111},"01M6AEBKDX0QFXTRRE4Z9P3F66","detecting-cryptomining-in-cloud",null,"This skill teaches security teams how to detect and respond to unauthorized cryptocurrency mining operations in cloud environments. It covers identifying cryptomining indicators through compute usage anomalies, network traffic patterns to mining pools, GuardDuty CryptoCurrency findings, and runtime process monitoring on EC2, ECS, EKS, and Azure Automation workloads.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",36078,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-cryptomining-in-cloud\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46],"detecting cryptomining in cloud","cloud","network","cost-anomaly","guardduty-crypto","resource-hijacking","cloud-abuse","cryptomining-detection","guardduty","eks","cryptocurrency","cybersecurity","cloud-security","server","monitoring","teams","development","pr","azure","automation","2026-11-10 10:12:30",false,"---\nname: detecting-cryptomining-in-cloud\ndescription: 'This skill teaches security teams how to detect and respond to unauthorized\n  cryptocurrency mining operations in cloud environments. It covers identifying cryptomining\n  indicators through compute usage anomalies, network traffic patterns to mining pools,\n  GuardDuty CryptoCurrency findings, and runtime process monitoring on EC2, ECS, EKS,\n  and Azure Automation workloads.\n\n  '\ndomain: cybersecurity\nsubdomain: cloud-security\ntags:\n- cryptomining-detection\n- cloud-abuse\n- resource-hijacking\n- guardduty-crypto\n- cost-anomaly\nversion: 1.0.0\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.IR-01\n- ID.AM-08\n- GV.SC-06\n- DE.CM-01\nmitre_attack:\n- T1078.004\n- T1530\n- T1537\n- T1580\n- T1071\nmitre_f3:\n  version: '1.1'\n  tactics:\n  - initial-access\n  - resource-development\n  - monetization\n  techniques:\n  - id: F1006.001\n    name: 'Account Takeover: Exposed API Key'\n    tactic: initial-access\n    source: f3\n  - id: T1586.003\n    name: 'Compromise Accounts: Cloud Accounts'\n    tactic: resource-development\n    source: attack\n  - id: T1583.003\n    name: 'Acquire Infrastructure: Virtual Private Network or Server'\n    tactic: resource-development\n    source: attack\n  - id: F1018\n    name: Convert to Cryptocurrency\n    tactic: monetization\n    source: f3\n---\n\n# Detecting Cryptomining in Cloud\n\n## When to Use\n\n- When cloud billing alerts indicate unexpected compute cost spikes\n- When GuardDuty generates CryptoCurrency or Impact finding types\n- When investigating compromised IAM credentials that may be used to launch mining instances\n- When monitoring container workloads for unauthorized process execution\n- When establishing proactive detection controls against resource hijacking attacks\n\n**Do not use** for legitimate cryptocurrency mining operations, for non-cloud mining detection on physical hardware, or for general malware analysis unrelated to mining activity.\n\n## Prerequisites\n\n- Amazon GuardDuty enabled with Runtime Monitoring for EC2, ECS, and EKS\n- CloudWatch or Azure Monitor configured for compute utilization alerting\n- VPC Flow Logs enabled for network traffic analysis to mining pool IPs\n- AWS Cost Anomaly Detection or Azure Cost Management alerts configured\n\n## Workflow\n\n### Step 1: Establish Detection Through Multiple Signals\n\nDeploy detection across four signal categories: cost anomalies, compute utilization, network traffic, and runtime processes.\n\n```bash\n# AWS Cost Anomaly Detection\naws ce create-anomaly-monitor \\\n  --anomaly-monitor '{\n    \"MonitorName\": \"EC2CostSpike\",\n    \"MonitorType\": \"DIMENSIONAL\",\n    \"MonitorDimension\": \"SERVICE\"\n  }'\n\naws ce create-anomaly-subscription \\\n  --anomaly-subscription '{\n    \"SubscriptionName\": \"CryptoMiningAlert\",\n    \"MonitorArnList\": [\"arn:aws:ce::123456789012:anomalymonitor\u002Fmonitor-id\"],\n    \"Subscribers\": [{\"Address\": \"security@company.com\", \"Type\": \"EMAIL\"}],\n    \"Threshold\": 50.0,\n    \"Frequency\": \"IMMEDIATE\"\n  }'\n\n# CloudWatch alarm for CPU utilization spike\naws cloudwatch put-metric-alarm \\\n  --alarm-name HighCPUUtilization \\\n  --namespace AWS\u002FEC2 \\\n  --metric-name CPUUtilization \\\n  --statistic Average \\\n  --period 300 \\\n  --threshold 90 \\\n  --comparison-operator GreaterThanThreshold \\\n  --evaluation-periods 3 \\\n  --alarm-actions \"arn:aws:sns:us-east-1:123456789012:security-alerts\"\n```\n\n### Step 2: Monitor GuardDuty CryptoCurrency Findings\n\nConfigure alerting for GuardDuty findings specific to cryptocurrency mining activity on EC2, ECS, and EKS workloads.\n\nKey GuardDuty finding types for cryptomining:\n- `CryptoCurrency:EC2\u002FBitcoinTool.B` - Network connections to crypto-related domains\n- `CryptoCurrency:Runtime\u002FBitcoinTool.B` - Runtime detection of mining process execution\n- `Impact:EC2\u002FBitcoinTool.B` - EC2 instance communicating with known Bitcoin mining pools\n- `Impact:Runtime\u002FCryptoMinerExecuted` - Crypto mining binary execution detected by runtime agent\n\n```bash\n# EventBridge rule for cryptocurrency findings\naws events put-rule \\\n  --name CryptoMiningDetection \\\n  --event-pattern '{\n    \"source\": [\"aws.guardduty\"],\n    \"detail-type\": [\"GuardDuty Finding\"],\n    \"detail\": {\n      \"type\": [\n        {\"prefix\": \"CryptoCurrency:\"},\n        {\"prefix\": \"Impact:EC2\u002FBitcoinTool\"},\n        {\"prefix\": \"Impact:Runtime\u002FCryptoMiner\"}\n      ]\n    }\n  }'\n\n# Auto-remediation Lambda for crypto findings\naws events put-targets \\\n  --rule CryptoMiningDetection \\\n  --targets '[{\n    \"Id\": \"CryptoAutoRemediate\",\n    \"Arn\": \"arn:aws:lambda:us-east-1:123456789012:function\u002Fcrypto-remediate\"\n  }]'\n```\n\n### Step 3: Analyze Network Traffic for Mining Pool Connections\n\nMonitor VPC Flow Logs and DNS queries for connections to known cryptocurrency mining pools operating on common ports (3333, 4444, 5555, 8333, 9999, 14444).\n\n```kql\n\u002F\u002F Sentinel KQL query for mining pool connections\nAzureNetworkAnalytics_CL\n| where TimeGenerated > ago(24h)\n| where DestPort_d in (3333, 4444, 5555, 8333, 9999, 14444, 14433, 45700)\n| summarize ConnectionCount = count(), BytesSent = sum(BytesSent_d)\n            by SrcIP_s, DestIP_s, DestPort_d, bin(TimeGenerated, 1h)\n| where ConnectionCount > 10\n| project TimeGenerated, SrcIP_s, DestIP_s, DestPort_d, ConnectionCount, BytesSent\n```\n\n```bash\n# AWS Athena query for VPC Flow Logs mining pool detection\ncat \u003C\u003C 'EOF' > mining-detection.sql\nSELECT srcaddr, dstaddr, dstport, protocol,\n       COUNT(*) as connection_count,\n       SUM(bytes) as total_bytes\nFROM vpc_flow_logs\nWHERE dstport IN (3333, 4444, 5555, 8333, 9999, 14444)\n  AND action = 'ACCEPT'\n  AND start >= date_add('hour', -24, now())\nGROUP BY srcaddr, dstaddr, dstport, protocol\nHAVING COUNT(*) > 10\nORDER BY connection_count DESC\nEOF\n```\n\n### Step 4: Detect Mining in Container Environments\n\nMonitor ECS task definitions and EKS pod deployments for known mining container images and suspicious process execution.\n\n```bash\n# Check for recently registered ECS task definitions with suspicious images\naws ecs list-task-definitions --sort DESC --max-items 50 | \\\n  jq -r '.taskDefinitionArns[]' | while read arn; do\n    aws ecs describe-task-definition --task-definition \"$arn\" \\\n      --query 'taskDefinition.containerDefinitions[*].[name,image]' --output text\n  done\n\n# Known malicious mining images to watch for:\n# - Images with high pull counts from unknown registries\n# - Images containing xmrig, cpuminer, minergate, or ccminer binaries\n# - Images with entrypoint pointing to \u002Ftmp\u002F.hidden or \u002Fdev\u002Fshm paths\n\n# Monitor CloudTrail for suspicious ECS\u002FEKS activity\naws cloudtrail lookup-events \\\n  --lookup-attributes AttributeKey=EventName,AttributeValue=RegisterTaskDefinition \\\n  --start-time $(date -d '-24 hours' +%Y-%m-%dT%H:%M:%S) \\\n  --query 'Events[*].[EventName,Username,EventTime]'\n```\n\n### Step 5: Respond and Contain Mining Activity\n\nExecute immediate containment actions when mining is confirmed, preserving forensic evidence before terminating the malicious workloads.\n\n```python\n# Auto-remediation Lambda for cryptomining incidents\nimport boto3\nimport json\n\ndef lambda_handler(event, context):\n    finding = event['detail']\n    resource_type = finding['resource']['resourceType']\n\n    if resource_type == 'Instance':\n        instance_id = finding['resource']['instanceDetails']['instanceId']\n        ec2 = boto3.client('ec2')\n\n        # Snapshot EBS volumes for forensics before isolation\n        volumes = ec2.describe_instances(InstanceIds=[instance_id])\n        for reservation in volumes['Reservations']:\n            for instance in reservation['Instances']:\n                for vol in instance['BlockDeviceMappings']:\n                    volume_id = vol['Ebs']['VolumeId']\n                    ec2.create_snapshot(\n                        VolumeId=volume_id,\n                        Description=f'Forensic snapshot - crypto mining - {instance_id}',\n                        TagSpecifications=[{\n                            'ResourceType': 'snapshot',\n                            'Tags': [{'Key': 'Incident', 'Value': 'CryptoMining'},\n                                     {'Key': 'SourceInstance', 'Value': instance_id}]\n                        }]\n                    )\n\n        # Disable API termination protection if set by attacker\n        ec2.modify_instance_attribute(\n            InstanceId=instance_id,\n            DisableApiTermination={'Value': False}\n        )\n\n        # Isolate instance with empty security group\n        vpc_id = finding['resource']['instanceDetails']['networkInterfaces'][0]['vpcId']\n        isolation_sg = ec2.create_security_group(\n            GroupName=f'crypto-isolation-{instance_id}',\n            Description='Cryptomining isolation - no traffic allowed',\n            VpcId=vpc_id\n        )\n        # Revoke default egress rule\n        ec2.revoke_security_group_egress(\n            GroupId=isolation_sg['GroupId'],\n            IpPermissions=[{'IpProtocol': '-1', 'IpRanges': [{'CidrIp': '0.0.0.0\u002F0'}]}]\n        )\n        ec2.modify_instance_attribute(\n            InstanceId=instance_id,\n            Groups=[isolation_sg['GroupId']]\n        )\n\n        return {'status': 'contained', 'instance': instance_id}\n```\n\n### Step 6: Trace Initial Access Vector\n\nInvestigate CloudTrail logs to determine how the attacker gained access to deploy mining workloads. Common vectors include compromised IAM credentials, exposed access keys, and supply chain attacks through container images.\n\n```bash\n# Trace the initial access for the compromised identity\naws cloudtrail lookup-events \\\n  --lookup-attributes AttributeKey=Username,AttributeValue=compromised-user \\\n  --start-time 2025-02-01T00:00:00Z \\\n  --query 'Events[?EventName==`ConsoleLogin` || EventName==`GetSessionToken`].[EventTime,SourceIPAddress,EventName]' \\\n  --output table\n\n# Check for RunInstances calls in unusual regions\nfor region in $(aws ec2 describe-regions --query 'Regions[*].RegionName' --output text); do\n  count=$(aws cloudtrail lookup-events \\\n    --region $region \\\n    --lookup-attributes AttributeKey=EventName,AttributeValue=RunInstances \\\n    --start-time $(date -d '-7 days' +%Y-%m-%dT%H:%M:%S) \\\n    --query 'Events | length(@)')\n  if [ \"$count\" -gt 0 ]; then\n    echo \"Region: $region - RunInstances calls: $count\"\n  fi\ndone\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| Cryptojacking | Unauthorized use of cloud compute resources to mine cryptocurrency, typically Monero (XMR) due to its CPU-friendly algorithm |\n| Stratum Protocol | Mining pool communication protocol operating on TCP ports 3333, 4444, or custom ports, identifiable in network flow logs |\n| XMRig | Open-source Monero mining software commonly found in cryptojacking attacks, often deployed as a hidden binary in containers |\n| API Termination Protection | EC2 attribute that attackers enable to prevent security teams from quickly terminating compromised mining instances |\n| Cost Anomaly Detection | AWS service that uses machine learning to identify unusual spending patterns that may indicate unauthorized resource usage |\n| Runtime Monitoring | GuardDuty capability that deploys agents to detect process-level activity including crypto mining binary execution |\n| Attack Sequence | GuardDuty Extended Threat Detection finding correlating credential theft, infrastructure deployment, and mining execution into a single Critical event |\n\n## Tools & Systems\n\n- **Amazon GuardDuty**: Detects cryptocurrency mining through network traffic analysis, DNS queries, and runtime process monitoring\n- **AWS Cost Anomaly Detection**: Machine learning-based service identifying unexpected cost increases from mining instance deployment\n- **VPC Flow Logs**: Network traffic metadata showing connections to mining pool IP addresses and ports\n- **Falco**: Open-source runtime security tool for detecting crypto mining process execution in containers\n- **Amazon Detective**: Graph-based investigation tool for tracing the attack path from initial access to mining deployment\n\n## Common Scenarios\n\n### Scenario: Compromised IAM Credentials Used for Large-Scale EC2 Mining\n\n**Context**: Exposed IAM credentials from a public GitHub repository are used to launch 200 GPU instances across 8 AWS regions within 10 minutes. The attacker enables API termination protection and disables CloudTrail in each region.\n\n**Approach**:\n1. AWS Cost Anomaly Detection triggers an immediate alert for $15,000+ hourly EC2 spend\n2. GuardDuty generates Stealth:IAMUser\u002FCloudTrailLoggingDisabled and CryptoCurrency:EC2\u002FBitcoinTool.B findings\n3. Immediately deactivate the compromised IAM access key\n4. Re-enable CloudTrail in all affected regions to restore visibility\n5. Disable API termination protection on all 200 instances and terminate them\n6. Create forensic snapshots of representative instances before termination\n7. Review the GitHub commit history to identify and remove the exposed credentials\n8. Deploy AWS Config rules preventing CloudTrail disabling and enforcing IMDSv2\n\n**Pitfalls**: Failing to check all AWS regions for mining instances leaves active miners running in overlooked regions. Not disabling API termination protection before attempting to stop instances wastes response time.\n\n## Output Format\n\n```\nCryptomining Incident Response Report\n=======================================\nIncident ID: INC-2025-0223-CRYPTO\nDetection Time: 2025-02-23T14:23:00Z\nContainment Time: 2025-02-23T14:41:00Z (18 minutes)\n\nINITIAL ACCESS:\n  Vector: Exposed IAM access key in public GitHub repository\n  Credential: AKIAIOSFODNN7EXAMPLE (user: ci-deploy)\n  First Malicious Activity: 2025-02-23T14:12:00Z\n\nIMPACT:\n  Instances Launched: 200 (p3.2xlarge GPU instances)\n  Regions Affected: 8 (us-east-1, us-west-2, eu-west-1, eu-central-1, ...)\n  Estimated Cost: $4,200 (18 minutes at $15,400\u002Fhour)\n  Mining Pool: stratum+tcp:\u002F\u002Fpool.supportxmr.com:3333\n  Cryptocurrency: Monero (XMR)\n\nDETECTION SIGNALS:\n  [14:15] GuardDuty: Stealth:IAMUser\u002FCloudTrailLoggingDisabled (HIGH)\n  [14:18] Cost Anomaly: EC2 spend 4,200% above baseline\n  [14:23] GuardDuty: CryptoCurrency:EC2\u002FBitcoinTool.B (HIGH) x 200\n\nCONTAINMENT ACTIONS:\n  [14:25] IAM access key AKIAIOSFODNN7EXAMPLE deactivated\n  [14:30] CloudTrail re-enabled in all 8 regions\n  [14:35] API termination protection disabled on 200 instances\n  [14:41] All 200 instances terminated\n\nREMEDIATION:\n  - Compromised access key deleted\n  - GitHub repository secret scanning enabled\n  - AWS Config rule deployed: cloudtrail-enabled (auto-remediate)\n  - SCP deployed: deny ec2:RunInstances for GPU instance types without approval\n```\n","# Detecting Cryptomining in Cloud\n\n## When to Use\n\n- When cloud billing alerts indicate unexpected compute cost spikes\n- When GuardDuty generates CryptoCurrency or Impact finding types\n- When investigating compromised IAM credentials that may be used to launch mining instances\n- When monitoring container workloads for unauthorized process execution\n- When establishing proactive detection controls against resource hijacking attacks\n\n**Do not use** for legitimate cryptocurrency mining operations, for non-cloud mining detection on physical hardware, or for general malware analysis unrelated to mining activity.\n\n## Prerequisites\n\n- Amazon GuardDuty enabled with Runtime Monitoring for EC2, ECS, and EKS\n- CloudWatch or Azure Monitor configured for compute utilization alerting\n- VPC Flow Logs enabled for network traffic analysis to mining pool IPs\n- AWS Cost Anomaly Detection or Azure Cost Management alerts configured\n\n## Workflow\n\n### Step 1: Establish Detection Through Multiple Signals\n\nDeploy detection across four signal categories: cost anomalies, compute utilization, network traffic, and runtime processes.\n\n```bash\n# AWS Cost Anomaly Detection\naws ce create-anomaly-monitor \\\n  --anomaly-monitor '{\n    \"MonitorName\": \"EC2CostSpike\",\n    \"MonitorType\": \"DIMENSIONAL\",\n    \"MonitorDimension\": \"SERVICE\"\n  }'\n\naws ce create-anomaly-subscription \\\n  --anomaly-subscription '{\n    \"SubscriptionName\": \"CryptoMiningAlert\",\n    \"MonitorArnList\": [\"arn:aws:ce::123456789012:anomalymonitor\u002Fmonitor-id\"],\n    \"Subscribers\": [{\"Address\": \"security@company.com\", \"Type\": \"EMAIL\"}],\n    \"Threshold\": 50.0,\n    \"Frequency\": \"IMMEDIATE\"\n  }'\n\n# CloudWatch alarm for CPU utilization spike\naws cloudwatch put-metric-alarm \\\n  --alarm-name HighCPUUtilization \\\n  --namespace AWS\u002FEC2 \\\n  --metric-name CPUUtilization \\\n  --statistic Average \\\n  --period 300 \\\n  --threshold 90 \\\n  --comparison-operator GreaterThanThreshold \\\n  --evaluation-periods 3 \\\n  --alarm-actions \"arn:aws:sns:us-east-1:123456789012:security-alerts\"\n```\n\n### Step 2: Monitor GuardDuty CryptoCurrency Findings\n\nConfigure alerting for GuardDuty findings specific to cryptocurrency mining activity on EC2, ECS, and EKS workloads.\n\nKey GuardDuty finding types for cryptomining:\n- `CryptoCurrency:EC2\u002FBitcoinTool.B` - Network connections to crypto-related domains\n- `CryptoCurrency:Runtime\u002FBitcoinTool.B` - Runtime detection of mining process execution\n- `Impact:EC2\u002FBitcoinTool.B` - EC2 instance communicating with known Bitcoin mining pools\n- `Impact:Runtime\u002FCryptoMinerExecuted` - Crypto mining binary execution detected by runtime agent\n\n```bash\n# EventBridge rule for cryptocurrency findings\naws events put-rule \\\n  --name CryptoMiningDetection \\\n  --event-pattern '{\n    \"source\": [\"aws.guardduty\"],\n    \"detail-type\": [\"GuardDuty Finding\"],\n    \"detail\": {\n      \"type\": [\n        {\"prefix\": \"CryptoCurrency:\"},\n        {\"prefix\": \"Impact:EC2\u002FBitcoinTool\"},\n        {\"prefix\": \"Impact:Runtime\u002FCryptoMiner\"}\n      ]\n    }\n  }'\n\n# Auto-remediation Lambda for crypto findings\naws events put-targets \\\n  --rule CryptoMiningDetection \\\n  --targets '[{\n    \"Id\": \"CryptoAutoRemediate\",\n    \"Arn\": \"arn:aws:lambda:us-east-1:123456789012:function\u002Fcrypto-remediate\"\n  }]'\n```\n\n### Step 3: Analyze Network Traffic for Mining Pool Connections\n\nMonitor VPC Flow Logs and DNS queries for connections to known cryptocurrency mining pools operating on common ports (3333, 4444, 5555, 8333, 9999, 14444).\n\n```kql\n\u002F\u002F Sentinel KQL query for mining pool connections\nAzureNetworkAnalytics_CL\n| where TimeGenerated > ago(24h)\n| where DestPort_d in (3333, 4444, 5555, 8333, 9999, 14444, 14433, 45700)\n| summarize ConnectionCount = count(), BytesSent = sum(BytesSent_d)\n            by SrcIP_s, DestIP_s, DestPort_d, bin(TimeGenerated, 1h)\n| where ConnectionCount > 10\n| project TimeGenerated, SrcIP_s, DestIP_s, DestPort_d, ConnectionCount, BytesSent\n```\n\n```bash\n# AWS Athena query for VPC Flow Logs mining pool detection\ncat \u003C\u003C 'EOF' > mining-detection.sql\nSELECT srcaddr, dstaddr, dstport, protocol,\n       COUNT(*) as connection_count,\n       SUM(bytes) as total_bytes\nFROM vpc_flow_logs\nWHERE dstport IN (3333, 4444, 5555, 8333, 9999, 14444)\n  AND action = 'ACCEPT'\n  AND start >= date_add('hour', -24, now())\nGROUP BY srcaddr, dstaddr, dstport, protocol\nHAVING COUNT(*) > 10\nORDER BY connection_count DESC\nEOF\n```\n\n### Step 4: Detect Mining in Container Environments\n\nMonitor ECS task definitions and EKS pod deployments for known mining container images and suspicious process execution.\n\n```bash\n# Check for recently registered ECS task definitions with suspicious images\naws ecs list-task-definitions --sort DESC --max-items 50 | \\\n  jq -r '.taskDefinitionArns[]' | while read arn; do\n    aws ecs describe-task-definition --task-definition \"$arn\" \\\n      --query 'taskDefinition.containerDefinitions[*].[name,image]' --output text\n  done\n\n# Known malicious mining images to watch for:\n# - Images with high pull counts from unknown registries\n# - Images containing xmrig, cpuminer, minergate, or ccminer binaries\n# - Images with entrypoint pointing to \u002Ftmp\u002F.hidden or \u002Fdev\u002Fshm paths\n\n# Monitor CloudTrail for suspicious ECS\u002FEKS activity\naws cloudtrail lookup-events \\\n  --lookup-attributes AttributeKey=EventName,AttributeValue=RegisterTaskDefinition \\\n  --start-time $(date -d '-24 hours' +%Y-%m-%dT%H:%M:%S) \\\n  --query 'Events[*].[EventName,Username,EventTime]'\n```\n\n### Step 5: Respond and Contain Mining Activity\n\nExecute immediate containment actions when mining is confirmed, preserving forensic evidence before terminating the malicious workloads.\n\n```python\n# Auto-remediation Lambda for cryptomining incidents\nimport boto3\nimport json\n\ndef lambda_handler(event, context):\n    finding = event['detail']\n    resource_type = finding['resource']['resourceType']\n\n    if resource_type == 'Instance':\n        instance_id = finding['resource']['instanceDetails']['instanceId']\n        ec2 = boto3.client('ec2')\n\n        # Snapshot EBS volumes for forensics before isolation\n        volumes = ec2.describe_instances(InstanceIds=[instance_id])\n        for reservation in volumes['Reservations']:\n            for instance in reservation['Instances']:\n                for vol in instance['BlockDeviceMappings']:\n                    volume_id = vol['Ebs']['VolumeId']\n                    ec2.create_snapshot(\n                        VolumeId=volume_id,\n                        Description=f'Forensic snapshot - crypto mining - {instance_id}',\n                        TagSpecifications=[{\n                            'ResourceType': 'snapshot',\n                            'Tags': [{'Key': 'Incident', 'Value': 'CryptoMining'},\n                                     {'Key': 'SourceInstance', 'Value': instance_id}]\n                        }]\n                    )\n\n        # Disable API termination protection if set by attacker\n        ec2.modify_instance_attribute(\n            InstanceId=instance_id,\n            DisableApiTermination={'Value': False}\n        )\n\n        # Isolate instance with empty security group\n        vpc_id = finding['resource']['instanceDetails']['networkInterfaces'][0]['vpcId']\n        isolation_sg = ec2.create_security_group(\n            GroupName=f'crypto-isolation-{instance_id}',\n            Description='Cryptomining isolation - no traffic allowed',\n            VpcId=vpc_id\n        )\n        # Revoke default egress rule\n        ec2.revoke_security_group_egress(\n            GroupId=isolation_sg['GroupId'],\n            IpPermissions=[{'IpProtocol': '-1', 'IpRanges': [{'CidrIp': '0.0.0.0\u002F0'}]}]\n        )\n        ec2.modify_instance_attribute(\n            InstanceId=instance_id,\n            Groups=[isolation_sg['GroupId']]\n        )\n\n        return {'status': 'contained', 'instance': instance_id}\n```\n\n### Step 6: Trace Initial Access Vector\n\nInvestigate CloudTrail logs to determine how the attacker gained access to deploy mining workloads. Common vectors include compromised IAM credentials, exposed access keys, and supply chain attacks through container images.\n\n```bash\n# Trace the initial access for the compromised identity\naws cloudtrail lookup-events \\\n  --lookup-attributes AttributeKey=Username,AttributeValue=compromised-user \\\n  --start-time 2025-02-01T00:00:00Z \\\n  --query 'Events[?EventName==`ConsoleLogin` || EventName==`GetSessionToken`].[EventTime,SourceIPAddress,EventName]' \\\n  --output table\n\n# Check for RunInstances calls in unusual regions\nfor region in $(aws ec2 describe-regions --query 'Regions[*].RegionName' --output text); do\n  count=$(aws cloudtrail lookup-events \\\n    --region $region \\\n    --lookup-attributes AttributeKey=EventName,AttributeValue=RunInstances \\\n    --start-time $(date -d '-7 days' +%Y-%m-%dT%H:%M:%S) \\\n    --query 'Events | length(@)')\n  if [ \"$count\" -gt 0 ]; then\n    echo \"Region: $region - RunInstances calls: $count\"\n  fi\ndone\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| Cryptojacking | Unauthorized use of cloud compute resources to mine cryptocurrency, typically Monero (XMR) due to its CPU-friendly algorithm |\n| Stratum Protocol | Mining pool communication protocol operating on TCP ports 3333, 4444, or custom ports, identifiable in network flow logs |\n| XMRig | Open-source Monero mining software commonly found in cryptojacking attacks, often deployed as a hidden binary in containers |\n| API Termination Protection | EC2 attribute that attackers enable to prevent security teams from quickly terminating compromised mining instances |\n| Cost Anomaly Detection | AWS service that uses machine learning to identify unusual spending patterns that may indicate unauthorized resource usage |\n| Runtime Monitoring | GuardDuty capability that deploys agents to detect process-level activity including crypto mining binary execution |\n| Attack Sequence | GuardDuty Extended Threat Detection finding correlating credential theft, infrastructure deployment, and mining execution into a single Critical event |\n\n## Tools & Systems\n\n- **Amazon GuardDuty**: Detects cryptocurrency mining through network traffic analysis, DNS queries, and runtime process monitoring\n- **AWS Cost Anomaly Detection**: Machine learning-based service identifying unexpected cost increases from mining instance deployment\n- **VPC Flow Logs**: Network traffic metadata showing connections to mining pool IP addresses and ports\n- **Falco**: Open-source runtime security tool for detecting crypto mining process execution in containers\n- **Amazon Detective**: Graph-based investigation tool for tracing the attack path from initial access to mining deployment\n\n## Common Scenarios\n\n### Scenario: Compromised IAM Credentials Used for Large-Scale EC2 Mining\n\n**Context**: Exposed IAM credentials from a public GitHub repository are used to launch 200 GPU instances across 8 AWS regions within 10 minutes. The attacker enables API termination protection and disables CloudTrail in each region.\n\n**Approach**:\n1. AWS Cost Anomaly Detection triggers an immediate alert for $15,000+ hourly EC2 spend\n2. GuardDuty generates Stealth:IAMUser\u002FCloudTrailLoggingDisabled and CryptoCurrency:EC2\u002FBitcoinTool.B findings\n3. Immediately deactivate the compromised IAM access key\n4. Re-enable CloudTrail in all affected regions to restore visibility\n5. Disable API termination protection on all 200 instances and terminate them\n6. Create forensic snapshots of representative instances before termination\n7. Review the GitHub commit history to identify and remove the exposed credentials\n8. Deploy AWS Config rules preventing CloudTrail disabling and enforcing IMDSv2\n\n**Pitfalls**: Failing to check all AWS regions for mining instances leaves active miners running in overlooked regions. Not disabling API termination protection before attempting to stop instances wastes response time.\n\n## Output Format\n\n```\nCryptomining Incident Response Report\n=======================================\nIncident ID: INC-2025-0223-CRYPTO\nDetection Time: 2025-02-23T14:23:00Z\nContainment Time: 2025-02-23T14:41:00Z (18 minutes)\n\nINITIAL ACCESS:\n  Vector: Exposed IAM access key in public GitHub repository\n  Credential: AKIAIOSFODNN7EXAMPLE (user: ci-deploy)\n  First Malicious Activity: 2025-02-23T14:12:00Z\n\nIMPACT:\n  Instances Launched: 200 (p3.2xlarge GPU instances)\n  Regions Affected: 8 (us-east-1, us-west-2, eu-west-1, eu-central-1, ...)\n  Estimated Cost: $4,200 (18 minutes at $15,400\u002Fhour)\n  Mining Pool: stratum+tcp:\u002F\u002Fpool.supportxmr.com:3333\n  Cryptocurrency: Monero (XMR)\n\nDETECTION SIGNALS:\n  [14:15] GuardDuty: Stealth:IAMUser\u002FCloudTrailLoggingDisabled (HIGH)\n  [14:18] Cost Anomaly: EC2 spend 4,200% above baseline\n  [14:23] GuardDuty: CryptoCurrency:EC2\u002FBitcoinTool.B (HIGH) x 200\n\nCONTAINMENT ACTIONS:\n  [14:25] IAM access key AKIAIOSFODNN7EXAMPLE deactivated\n  [14:30] CloudTrail re-enabled in all 8 regions\n  [14:35] API termination protection disabled on 200 instances\n  [14:41] All 200 instances terminated\n\nREMEDIATION:\n  - Compromised access key deleted\n  - GitHub repository secret scanning enabled\n  - AWS Config rule deployed: cloudtrail-enabled (auto-remediate)\n  - SCP deployed: deny ec2:RunInstances for GPU instance types without approval\n```\n",{"name":5,"tags":52,"author":53,"domain":38,"license":15,"version":54,"mitre_f3":55,"nist_csf":76,"subdomain":39,"description":81,"mitre_attack":82},[34,33,32,31,30],"mahipal","1.0.0",{"tactics":56,"version":60,"techniques":61},[57,58,59],"initial-access","resource-development","monetization","1.1",[62,66,70,73],{"id":63,"name":64,"source":65,"tactic":57},"F1006.001","Account Takeover: Exposed API Key","f3",{"id":67,"name":68,"source":69,"tactic":58},"T1586.003","Compromise Accounts: Cloud Accounts","attack",{"id":71,"name":72,"source":69,"tactic":58},"T1583.003","Acquire Infrastructure: Virtual Private Network or Server",{"id":74,"name":75,"source":65,"tactic":59},"F1018","Convert to Cryptocurrency",[77,78,79,80],"PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01","This skill teaches security teams how to detect and respond to unauthorized cryptocurrency mining operations in cloud environments. It covers identifying cryptomining indicators through compute usage anomalies, network traffic patterns to mining pools, GuardDuty CryptoCurrency findings, and runtime process monitoring on EC2, ECS, EKS, and Azure Automation workloads.\n",[83,84,85,86,87],"T1078.004","T1530","T1537","T1580","T1071","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fdetecting-cryptomining-in-cloud",4414,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":99,"prompt":109,"zipAvailable":110},[100,103,106],{"tool":101,"command":102},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill detecting-cryptomining-in-cloud",{"tool":104,"command":105},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill detecting-cryptomining-in-cloud",{"tool":107,"command":108},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill detecting-cryptomining-in-cloud","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-cryptomining-in-cloud\u002FSKILL.md",true,[112,117,123],{"path":113,"resourceType":113,"resourceTypeDesc":114,"sizeBytes":115,"sourceHtmlUrl":116},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-cryptomining-in-cloud\u002FLICENSE",{"path":118,"resourceType":119,"resourceTypeDesc":120,"sizeBytes":121,"sourceHtmlUrl":122},"references\u002Fapi-reference.md","REFERENCE","参考文档",2154,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-cryptomining-in-cloud\u002Freferences\u002Fapi-reference.md",{"path":124,"resourceType":125,"resourceTypeDesc":126,"sizeBytes":127,"sourceHtmlUrl":128},"scripts\u002Fagent.py","SCRIPT","脚本",6614,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-cryptomining-in-cloud\u002Fscripts\u002Fagent.py",[130,156,180,207,233,260],{"skillNo":131,"name":132,"nameZh":6,"description":133,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":134,"categories":135,"keywords":137,"publishedAt":47},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[136],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[138,139,140,141,142,38,143,144,44,145,146,147,148,149,150,151,152,153,154,155],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","identity","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":157,"name":158,"nameZh":6,"description":159,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":160,"categories":161,"keywords":163,"publishedAt":47},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[162],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[164,152,165,166,142,167,38,44,168,169,170,171,172,173,174,175,176,177,178,179],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":181,"name":182,"nameZh":6,"description":183,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":184,"categories":185,"keywords":190,"publishedAt":47},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[186,189],{"categoryNo":187,"categoryName":188,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[174,191,192,193,194,38,195,196,168,197,198,199,200,37,201,202,203,204,205,206],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":208,"name":209,"nameZh":6,"description":210,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":211,"categories":212,"keywords":214,"publishedAt":47},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[213],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[215,216,217,38,218,219,220,221,222,223,224,225,226,227,228,229,171,230,231,232],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":234,"name":235,"nameZh":6,"description":236,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":237,"categories":238,"keywords":240,"publishedAt":47},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[239],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[241,242,243,38,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":261,"name":262,"nameZh":6,"description":263,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":264,"categories":265,"keywords":267,"publishedAt":47},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[266],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[142,268,38,269,270,271,272,273,274,275,276,202,277,203,278,279,280,281,282,283],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]