Mining Attack Diagnosis (Read-Only)

Absolute Rules

1. CRITICAL — MANDATORY EXECUTION: You MUST run the investigation via the entry script scripts/mining_investigation.py. Do NOT hand-write bash/python, do NOT issue individual aliyun CLI calls, do NOT skip any step. If the script fails or times out, re-run it once before falling back — never abandon the 6-step SOP. The entry script internally invokes every Step 1–4 API (DescribeSuspEvents, DescribeAlarmEventDetail, DescribeSuspEventDetail, DescribeSecurityStatInfo, DescribeFieldStatistics, DescribeExposedInstanceList, DescribeVulList) regardless of intermediate results, and auto-retries transient ServiceUnavailable/Throttling/InternalError responses — so you must not pre-empt or short-circuit it with ad-hoc calls.
2. ABSOLUTE PROHIBITION (read-only enforcement): Under NO circumstances may you generate, write, or execute any command/script calling a mutating API (Update*/Delete*/Disable*/Modify*/Create*/Rotate*/Set*/Operate*) — e.g. OperateSuspiciousTargetBatch, ModifySecurityGroupRule, DeleteInstance. This includes scripts "for the user to run manually". If the user asks to quarantine/kill/isolate, only output the manual remediation workflow and declare this skill is read-only.
3. MANDATORY OUTPUT FORMAT: When mining is confirmed, the report MUST start with the URGENT banner (see Report Output section); the Conclusion section MUST include the 4-phase remediation workflow verbatim. Partial output is forbidden.
4. EXECUTION RULE FOR ERRORS: On any API error, log [WARN] <error> to stderr and continue to the next step — never silently skip. On Forbidden/NoPermission, record the missing permission and continue. On empty results, set fields to N/A and proceed. On transient errors (ServiceUnavailable/Throttling/InternalError), the entry script retries automatically — do not conclude "service down" from a single failed call.
5. INFORMATION COMPLETENESS (auto-fill first, ask second): When the user omits the account UID or region but the request intent is clear (e.g. only an API fragment like "describe susp"), do NOT stall asking for what can be derived — auto-derive the UID via sts:GetCallerIdentity (the entry script does this when --account is omitted), use the default region cn-hangzhou, state the derivation explicitly in your reply and in the report metadata ("account auto-derived via STS"), then run the full investigation. Only ask a brief clarifying question when the request is too ambiguous to determine the product or investigation goal at all. Never fabricate findings in either path.

Overview

This skill implements a standard 6-step operating procedure for Alibaba Cloud cryptomining (cryptojacking) detection and diagnosis. It detects mining alerts via Security Center (SAS), extracts Indicators of Compromise (IOCs) from alert detail, scopes the affected assets, detects the attack surface (exposed assets

• unpatched vulnerabilities) to hypothesize the intrusion entry, assesses risk, and generates a prioritized handling/remediation report.