Merge PR #6175 from @chrialonso - Update Network Communication With Crypto Mining Pool

update: Network Communication With Crypto Mining Pool - Split merged crypto pool domains and add 87 new entries from Maltrail

---------

Co-authored-by: Swachchhanda Shrawan Poudel <87493836+swachchhanda000@users.noreply.github.com>

Author: chrialonso

rules/windows/network_connection/net_connection_win_domain_crypto_mining_pools.yml

@@ -1,14 +1,16 @@
 title: Network Communication With Crypto Mining Pool
 id: fa5b1358-b040-4403-9868-15f7d9ab6329
 status: stable
-description: Detects initiated network connections to crypto mining pools
+description: |
+    Detects initiated network connections to crypto mining pools.
+    It indicates that the system is likely infected with a crypto miner malware or is being used for crypto mining.
 references:
     - https://www.poolwatch.io/coin/monero
-    - https://github.com/stamparm/maltrail/blob/3ea70459b9559134449423c0a7d8b965ac5c40ea/trails/static/suspicious/crypto_mining.txt
+    - https://github.com/stamparm/maltrail/blob/da082537e0f37b9dece3a6998583e43bb5709c4e/trails/static/suspicious/crypto_mining.txt
     - https://www.virustotal.com/gui/search/behaviour_network%253A*.miningocean.org/files
 author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
 date: 2021-10-26
-modified: 2024-01-19
+modified: 2026-07-24
 tags:
     - attack.impact
     - attack.t1496
@@ -18,11 +20,21 @@ logsource:
 detection:
     selection:
         DestinationHostname:
+            - 'aeon-pool.com'
             - 'alimabi.cn'
             - 'ap.luckpool.net'
+            - 'api.fastpool.xyz'
+            - 'auto.c3pool.org'
+            - 'awgoaigartnj-xmr.com'
+            - 'backup.fastpool.xyz'
             - 'bcn.pool.minergate.com'
             - 'bcn.vip.pool.minergate.com'
+            - 'bizxmr.cc'
+            - 'bmpool.org'
             - 'bohemianpool.com'
+            - 'byw.dscloud.me'
+            - 'c3.wptask.cyou'
+            - 'c3pool.org'
             - 'ca-aipg.miningocean.org'
             - 'ca-dynex.miningocean.org'
             - 'ca-neurai.miningocean.org'
@@ -33,9 +45,12 @@ detection:
             - 'ca.monero.herominers.com'
             - 'cbd.monerpool.org'
             - 'cbdv2.monerpool.org'
+            - 'community-pools.mysrv.cloud'
+            - 'covid19crypto.com'
             - 'cryptmonero.com'
             - 'crypto-pool.fr'
             - 'crypto-pool.info'
+            - 'cryptominded.com'
             - 'cryptonight-hub.miningpoolhub.com'
             - 'd1pool.ddns.net'
             - 'd5pool.us'
@@ -44,6 +59,9 @@ detection:
             - 'de-dynex.miningocean.org'
             - 'de-zephyr.miningocean.org'
             - 'de.minexmr.com'
+            - 'de.moneroocean.stream'
+            - 'de.salvium.herominers.com'
+            - 'de.zephyr.herominers.com'
             - 'dl.nbminer.com'
             - 'donate.graef.in'
             - 'donate.ssl.xmrig.com'
@@ -58,15 +76,26 @@ detection:
             - 'ethereumpool.co'
             - 'eu.luckpool.net'
             - 'eu.minerpool.pw'
+            - 'f2pool.com'
+            - 'fastpool.xyz'
             - 'fcn-xmr.pool.minergate.com'
             - 'fee.xmrig.com'
+            - 'fi.moneroocean.stream'
             - 'fr-aipg.miningocean.org'
             - 'fr-dynex.miningocean.org'
             - 'fr-neurai.miningocean.org'
             - 'fr-qrl.miningocean.org'
+            - 'fr-tarirx.luckypool.io'
             - 'fr-upx.miningocean.org'
             - 'fr-zephyr.miningocean.org'
             - 'fr.minexmr.com'
+            - 'fr.moneroocean.stream'
+            - 'friendspool.club'
+            - 'ftp.fastpool.xyz'
+            - 'gandalph3000.com'
+            - 'googleminer.com'
+            - 'grin.2miners.com'
+            - 'gulf.moneroocean.stream'
             - 'hellominer.com'
             - 'herominers.com'
             - 'hk-aipg.miningocean.org'
@@ -75,17 +104,31 @@ detection:
             - 'hk-qrl.miningocean.org'
             - 'hk-upx.miningocean.org'
             - 'hk-zephyr.miningocean.org'
+            - 'hns.f2pool.com'
             - 'huadong1-aeon.ppxxmr.com'
+            - 'imap.fastpool.xyz'
             - 'iwanttoearn.money'
+            - 'joulecoin.org'
+            - 'jp.moneroocean.stream'
             - 'jw-js1.ppxxmr.com'
             - 'koto-pool.work'
+            - 'kronecoin.org'
+            - 'kryptex.network'
+            - 'kubo.ultra-pool.com'
             - 'lhr.nbminer.com'
             - 'lhr3.nbminer.com'
             - 'linux.monerpool.org'
+            - 'litecoinpool.org'
             - 'lokiturtle.herominers.com'
             - 'luckpool.net'
+            - 'luckypool.io'
+            - 'mail.fastpool.xyz'
             - 'masari.miner.rocks'
+            - 'mine.aeon-pool.com'
+            - 'mine.bmpool.org'
             - 'mine.c3pool.com'
+            - 'mine.fastpool.xyz'
+            - 'mine.lesliejust.is'
             - 'mine.moneropool.com'
             - 'mine.ppxxmr.com'
             - 'mine.zpool.ca'
@@ -102,7 +145,10 @@ detection:
             - 'minexmr.cn'
             - 'minexmr.com'
             - 'mining-help.ru'
+            - 'mining.bittubeapp.com'
+            - 'miningocean.org'
             - 'miningpoolhub.com'
+            - 'miningrigrentals.com'
             - 'mixpools.org'
             - 'moner.monerpool.org'
             - 'moner1min.monerpool.org'
@@ -118,6 +164,7 @@ detection:
             - 'monerogb.com'
             - 'monerohash.com'
             - 'moneroocean.stream'
+            - 'monerooceans.stream'
             - 'moneropool.com'
             - 'moneropool.nl'
             - 'monerorx.com'
@@ -129,16 +176,24 @@ detection:
             - 'na.luckpool.net'
             - 'nanopool.org'
             - 'nbminer.com'
+            - 'node.btx.tools'
             - 'node3.luckpool.net'
             - 'noobxmr.com'
-            - 'pangolinminer.comgandalph3000.com'
+            - 'p06.2miners.com'
+            - 'pangolinminer.com'
+            - 'pool-de.supportxmr.com'
+            - 'pool-fr.supportxmr.com'
+            - 'pool-nyc.supportxmr.com'
+            - 'pool-phx.supportxmr.com'
             - 'pool.4i7i.com'
             - 'pool.armornetwork.org'
+            - 'pool.awgoaigartnj-xmr.com'
             - 'pool.cortins.tk'
             - 'pool.gntl.co.uk'
             - 'pool.hashvault.pro'
             - 'pool.minergate.com'
             - 'pool.minexmr.com'
+            - 'pool.minexmr.uk'
             - 'pool.monero.hashvault.pro'
             - 'pool.ppxxmr.com'
             - 'pool.somec.cc'
@@ -152,15 +207,21 @@ detection:
             - 'pooldd.com'
             - 'poolmining.org'
             - 'poolto.be'
+            - 'pop.fastpool.xyz'
             - 'ppxvip1.ppxxmr.com'
             - 'ppxxmr.com'
             - 'prohash.net'
             - 'r.twotouchauthentication.online'
             - 'randomx.xmrig.com'
             - 'ratchetmining.com'
+            - 'rx.unmineable.com'
+            - 'salvium.herominers.com'
             - 'seed.emercoin.com'
             - 'seed.emercoin.net'
             - 'seed.emergate.net'
+            - 'seed.kronecoin.org'
+            - 'seed.titcoinpool.com'
+            - 'seed.titcoins.info'
             - 'seed1.joulecoin.org'
             - 'seed2.joulecoin.org'
             - 'seed3.joulecoin.org'
@@ -178,21 +239,42 @@ detection:
             - 'sg.minexmr.com'
             - 'sheepman.mine.bz'
             - 'siamining.com'
+            - 'smtp.fastpool.xyz'
+            - 'solarray.club'
+            - 'solo-grin.2miners.com'
+            - 'solo-grin.2miners.ru'
+            - 'solo-xmr.2miners.com'
+            - 'solo-xmr.2miners.ru'
+            - 'soloxmr2min.dyndns.org'
+            - 'sparechange.io'
+            - 'ssl.fastpool.xyz'
             - 'sumokoin.minerrocks.com'
             - 'supportxmr.com'
             - 'suprnova.cc'
+            - 'system-check.services'
+            - 'system-update.info'
             - 'teracycle.net'
+            - 'titcoinpool.com'
+            - 'titcoins.info'
+            - 'tpool.yiluzhuanqian.com'
             - 'trtl.cnpool.cc'
             - 'trtl.pool.mine2gether.com'
             - 'turtle.miner.rocks'
+            - 'ultra-pool.com'
+            - 'unmineable.com'
             - 'us-aipg.miningocean.org'
             - 'us-dynex.miningocean.org'
+            - 'us-grin.2miners.com'
             - 'us-neurai.miningocean.org'
             - 'us-west.minexmr.com'
             - 'us-zephyr.miningocean.org'
             - 'usxmrpool.com'
             - 'viaxmr.com'
+            - 'web.xmrpool.eu'
             - 'webservicepag.webhop.net'
+            - 'winxmr.club'
+            - 'x109.node.btx.tools'
+            - 'xcn1.yiluzhuanqian.com'
             - 'xiazai.monerpool.org'
             - 'xiazai1.monerpool.org'
             - 'xmc.pool.minergate.com'
@@ -208,14 +290,17 @@ detection:
             - 'xmr-usa.dwarfpool.com'
             - 'xmr.2miners.com'
             - 'xmr.5b6b7b.ru'
+            - 'xmr.748pz.net'
             - 'xmr.alimabi.cn'
+            - 'xmr.bepooh.com'
             - 'xmr.bohemianpool.com'
             - 'xmr.crypto-pool.fr'
             - 'xmr.crypto-pool.info'
             - 'xmr.f2pool.com'
             - 'xmr.hashcity.org'
             - 'xmr.hex7e4.ru'
             - 'xmr.ip28.net'
+            - 'xmr.kryptex.network'
             - 'xmr.monerpool.org'
             - 'xmr.mypool.online'
             - 'xmr.nanopool.org'
@@ -229,6 +314,7 @@ detection:
             - 'xmr.suprnova.cc'
             - 'xmr.usa-138.com'
             - 'xmr.vip.pool.minergate.com'
+            - 'xmr.yiluzhuanqian.com'
             - 'xmr1min.monerpool.org'
             - 'xmrf.520fjh.org'
             - 'xmrf.fjhan.club'
@@ -243,7 +329,11 @@ detection:
             - 'xx11m.monerpool.org'
             - 'xx11mv2.monerpool.org'
             - 'xxx.hex7e4.ru'
+            - 'yes.fastpool.xyz'
             - 'zarabotaibitok.ru'
+            - 'zeph-eu2.nanopool.org'
+            - 'zeph.2miners.com'
+            - 'zephyr.herominers.com'
             - 'zer0day.ru'
     condition: selection
 falsepositives: