IDS detecting Bitcoin Mining activity.

Hi John

I’ve not seen this myself but i’d raise a support ticket and get one of the support engineers to look into the logs for you

Regards

Chris Rogers

John,

Did you ever figure anything out? I got the same alert today:

Incident Summary

thanks for info

It’s important to have an IDS (Intrusion Detection System) in place to detect Bitcoin mining activity. Bitcoin mining is the process of adding new transactions to the blockchain, and it requires a significant amount of computational power. Unfortunately, some individuals may use malware to take control of other people’s computers or servers to use them to mine Bitcoin without the owners’ knowledge or consent. This can cause damage to the affected machines and can also lead to a loss of resources and revenue. By using an IDS to detect Bitcoin mining activity, it can help organizations to quickly identify published content and respond to any unauthorized mining activity on their networks, and take appropriate action to stop it. It is also important to have a good endpoint security solution in place to prevent the intrusion of malware and unauthorized access to the network.

Detecting Bitcoin mining activity and cryptocurrency scripts can be challenging as they often use legitimate system resources and network activity. However, Intrusion Detection Systems (IDS) can help in identifying some of the common patterns of such activities.

Some of the methods that can be used by IDS to detect Bitcoin mining activity and cryptocurrency scripts are:

1. Signature-based detection: This method involves matching known patterns of Bitcoin mining software and cryptocurrency script with the network traffic to identify the presence of such activity.
2. Anomaly detection: This method involves monitoring network traffic and system resource usage to identify unusual patterns of behavior that may be indicative of Bitcoin mining activity or cryptocurrency scripts.
3. Behavioral analysis: This method involves analyzing the behavior of processes on the system to identify processes that are using a large amount of system resources or are performing unusual actions that may be associated with Bitcoin mining activity or cryptocurrency scripts.

Our meraki dashboard produced IDS alerts for Mutli Coin CPU miners on our zerto z-vra instances – we thought these might be false positives but packet inspection showed signs of malicious commands being issued

Intrusion Detection Systems (IDS) are crucial in identifying Bitcoin mining activities, which can often be masked as benign processes. I recall a case where a company’s network was slowed down significantly. After a thorough investigation, it was discovered that a rogue employee had installed a Bitcoin miner on several systems. The IDS was able to detect the unusual network traffic and CPU usage, leading to the discovery. For those interested in Bitcoin, I’d suggest checking out bitcoin rpc node – it’s a reliable Bitcoin RPC node that I’ve found useful in my own crypto journey.