Detects cryptocurrency mining malware in AhnLab EPP V3 malware alert logs.

Overview

Priority	Low
Type	Stream
Log schema	ahnlab-epp-v3-malware
Message	안랩 EPP V3 암호화폐 채굴 악성코드 탐지: 호스트 $host_ip, 악성코드 $signature
Output field order	_log_time, hostname, host_ip, emp_name, dept_name, signature, file_path, file_status, md5
MITRE Techniques	T1496 Resource Hijacking
MITRE tactics	TA0040 Impact

Query

The AhnLab V3 antivirus engine detects cryptocurrency mining malware with signatures such as CoinMiner/Win.PhoenixMiner.R263897, CoinMiner/Win.Generic.C5729394, etc. Therefore, alerts are extracted when the signature value begins with CoinMiner/.

Target logger models

• AhnLab EPP syslog

Threat analysis

• Cryptocurrency mining malware consumes system resources for extended periods, causing high CPU/GPU usage, degraded performance, and increased power consumption.
• Attackers may install mining software by exploiting vulnerabilities or using compromised accounts, hijacking organizational resources for unauthorized mining activities.
• Some mining malware includes additional capabilities such as downloading secondary payloads, installing backdoors, or self-updating, potentially leading to further compromise.

False positives

• Detections may occur when cryptocurrency mining programs are operated internally or executed for research purposes.

  • If the activity is authorized, the endpoint’s IP address can be added as an exception.

Response actions

• Check the endpoint’s CPU/GPU utilization and network traffic patterns to determine whether mining activity actually occurred.
• Review the execution path, installation traces, and auto-start registry entries of the mining program, and remove any malicious components.
• Verify whether similar detections have occurred within the same network segment to identify potential lateral spread.
• Investigate the infection vector (vulnerability exploitation, weak passwords, exposed RDP services, etc.) and strengthen system patching, account security, and access control policies.