SG-094: Resource Abuse (Cryptomining)
Severity: HIGH
Cryptomining / compute theft: miner binaries (xmrig, cpuminer, ...), the stratum protocol, known mining-pool hosts, miner-only CLI flags, or a Monero wallet address.
Fires when
- A cryptominer binary is named (xmrig, cpuminer, minerd, cgminer, ethminer, nbminer, lolminer, phoenixminer, xmr-stak, nanominer).
- The stratum mining-pool protocol URL (stratum+tcp/ssl://) or a known mining-pool host (pool.minexmr, supportxmr, nanopool, f2pool, ethermine, nicehash, etc.) appears.
- A miner-only CLI flag is present (--donate-level, --coin monero, --algo randomx/kawpow) or a pool+wallet invocation (-o host:port -u <wallet>).
- A Monero wallet address (95-char) appears.
Remediation
No safe remediation: a file that triggers this rule should be rejected, not patched. Read the flagged lines in the source before deciding.