A host is potentially running a crypto miner (ASIM Web Session schema)
This rule identifies a web request with a user agent header known to belong to a crypto miner. This indicates a crypto miner may have infected the client machine.<br>You can add custom crypto mining indicating…
Description
This rule identifies a web request with a user agent header known to belong to a crypto miner. This indicates a crypto miner may have infected the client machine.<br>You can add custom crypto mining indicating User-Agent headers using a watchlist, for more information refer to the [UnusualUserAgents Watchlist](https://aka.ms/ASimUnusualUserAgentsWatchlist).<br><br> This analytic rule uses [ASIM](https://aka.ms/AboutASIM) and supports any built-in or custom source that supports the ASIM WebSession schema (ASIM WebSession Schema)
Detection logic
Detection requirements
- Platform
- ContainersIaaSLinuxmacOSSaaSWindows
The rule states no platform. This is derived from the ATT&CK technique it maps to.
- Log source product
- squidproxyzscaler
- Log source service
- commonsecuritylogsquidproxy_cl
MITRE ATT&CK mappings
0 exclusive techniques.This is coverage no other published rule has; it is not this rule's total technique count.
References
| Reference | Cited by |
|---|---|
| github.com/Azure/Azure-Sentinel/blob/master/Detections/CiscoUmbrella/CiscoUmbrellaCryptoMinerUserAgentDetected.yaml | Only this detection cites it |
From the source
- At source
- Open at source
- Upstream identifier
- 8cbc3215-fa58-4bd6-aaaa-f0029c351730
- Tagged by the source as
- ImpactSecurity - Threat Protection
Licence
- Published under
- MIT LicenseRead the licence
- Attribution
- Required
- Obtained under
- MITRead the origin licence
Authorship
- Written by
- Published
- Sep 2, 2026
- Version
- 1