detecting-cryptomining-in-cloud

name	detecting-cryptomining-in-cloud
description	Use when this skill teaches security teams how to detect and respond to unauthorized cryptocurrency mining operations in cloud environments. It covers identifying cryptomining indicators through compute usage anomalies, network traffic patterns to mining pools, GuardDuty CryptoCurrency findings, and runtime process monitoring on EC2, ECS, EKS, and Azure Automation workloads.
domain	cybersecurity
tags	["cryptomining-detection","cloud-abuse","resource-hijacking","guardduty-crypto","cost-anomaly"]
subdomain	cloud-security
version	1.0.0
author	oyi77
license	Apache-2.0
nist_csf	["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"]

Detecting Cryptomining In Cloud

Overview

Cybersecurity skill for detecting cryptomining in cloud. Follows industry best practices and security standards.

When to Use

Trigger phrases:

• "detecting cryptomining in cloud"

• "This skill teaches security teams how to detect and respond to unauthorized cryp"

• When cloud billing alerts indicate unexpected compute cost spikes

• When GuardDuty generates CryptoCurrency or Impact finding types

• When investigating compromised IAM credentials that may be used to launch mining instances

• When monitoring container workloads for unauthorized process execution

• When establishing proactive detection controls against resource hijacking attacks

Do not use for legitimate cryptocurrency mining operations, for non-cloud mining detection on physical hardware, or for general malware analysis unrelated to mining activity.

When NOT to Use

• When you lack proper authorization for testing
• For production systems without change management
• When the task requires legal or compliance expertise beyond technical scope

Prerequisites

• Amazon GuardDuty enabled with Runtime Monitoring for EC2, ECS, and EKS
• CloudWatch or Azure Monitor configured for compute utilization alerting
• VPC Flow Logs enabled for network traffic analysis to mining pool IPs
• AWS Cost Anomaly Detection or Azure Cost Management alerts configured

Workflow

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

def extract_iocs(text: str) -> dict:
    return {k: re.findall(v, text) for k, v  IOC_PATTERNS.items()}