Detecting Cryptomining in Cloud

When to Use

• When cloud billing alerts indicate unexpected compute cost spikes
• When GuardDuty generates CryptoCurrency or Impact finding types
• When investigating compromised IAM credentials that may be used to launch mining instances
• When monitoring container workloads for unauthorized process execution
• When establishing proactive detection controls against resource hijacking attacks

Do not use for legitimate cryptocurrency mining operations, for non-cloud mining detection on physical hardware, or for general malware analysis unrelated to mining activity.

Prerequisites

• Amazon GuardDuty enabled with Runtime Monitoring for EC2, ECS, and EKS
• CloudWatch or Azure Monitor configured for compute utilization alerting
• VPC Flow Logs enabled for network traffic analysis to mining pool IPs
• AWS Cost Anomaly Detection or Azure Cost Management alerts configured