Contain the Mining Workload and Entry Vector
Stop the miner, remove its persistence, and close the entry vector that allowed it in. Preserve the miner binary and persistence artifacts before removal so analysis can proceed.
Actions
- 1
Capture evidence first: copy the miner binary, config file, cron entries or scheduled task, and any dropped scripts to the evidence store (with hashes and chain-of-custody metadata) before removal.
- 2
Kill the mining process(es) and any parent/worker processes; on Linux use `ps -ef` and `pstree` to identify the full tree; on Windows review suspicious svchost or powershell children.
- 3
Remove persistence: cron entries, systemd units, `/etc/rc.local` additions, Windows Scheduled Tasks, Windows Services, Registry Run keys.
- 4
Block known mining pool domains and stratum ports (3333, 4444, 7777, 14444) at firewall/DNS layer; subscribe to community mining-pool blocklists for broader coverage.
- 5
Close the entry vector: patch the exploitable service (Log4j, Confluence, Spring, etc.), restrict exposed management endpoints (Docker socket, Redis, Jenkins, Kubernetes API) to internal networks only, rotate credentials that were re-used or brute-forced.
- 6
For containerized workloads: delete the compromised container; rebuild from a clean image with the entry vector patched; add admission policies to prevent privileged or host-network containers that allow escape.
Queries
crontab -l && ls -la /etc/cron.d /etc/cron.daily /etc/cron.hourly /etc/cron.weekly /var/spool/cron/
systemctl list-units --type=service --state=running; systemctl list-unit-files --type=service --state=enabled
Get-ScheduledTask | Where-Object {$_.State -eq "Ready" -and $_.Actions.Execute -match "powershell|cmd|wscript|cscript"} | Select TaskName, ActionsGet-ChildItem -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run","HKCU:\Software\Microsoft\Windows\CurrentVersion\Run" -Recurse -ErrorAction SilentlyContinue
Notes
Miner families like Sysrv-hello and Kinsing install multiple persistence mechanisms -- remove the miner, confirm no re-spawn, then sweep again after 1-4 hours.
Mining campaigns often re-propagate via internal scanning from the compromised host; check outbound SSH/SMB/Docker scans before declaring contained.
If the entry vector is a CVE, ensure the patch is applied environment-wide, not just on the detected host.