Use Case: Cloud
Cryptomining and resource hijacking
48 p3.16xlarge GPU instances launched in 6 AWS regions over 20 minutes. $40,000 per hour in compute costs. ManySignal identified the mining pool connections 8 minutes after the first instance started.
The $150,000 AWS bill that arrived on Monday
Cryptojacking — using compromised cloud credentials to mine cryptocurrency at the victim's expense — is one of the fastest-growing cloud attack vectors. An attacker who gains access to AWS, GCP, or Azure credentials (often via a leaked CI/CD secret or exposed EC2 metadata endpoint) can launch hundreds of high-GPU instances in multiple regions within minutes. The compute cost is borne by the compromised account; the mining profit goes to the attacker.
The detection window matters enormously: at $10,000/hour in compute costs, a 15-hour undetected mining operation generates $150,000 in cloud spend before the security team discovers the anomaly on Monday morning when someone checks the billing console.
rule: cryptomining_cloud_resource_abuse
type: behavioral + network + cost_anomaly
sources:
- aws_cloudtrail (RunInstances)
- netflow / vpc_flow_logs
- dns_query_log
- cloud_cost_anomaly_api
trigger:
- OR:
- condition: |
instance_type IN [p3.*, g4dn.*, p4d.*] AND
count(RunInstances) > 10 WITHIN 30m
- condition: outbound_connection.domain IN mining_pool_domains_db
- condition: cost_anomaly_score > 85 (AWS Cost Anomaly Detection)
enrichments:
- mining_pool_check: xmrig_pools, ethermine, f2pool, etc.
- cost_projection: hourly_burn_rate
- compromised_cred: source_credential_analysis
mitre: T1496 (Resource Hijacking)MITRE ATT&CK mapping
Cryptomining detection FAQ
How does ManySignal detect cryptomining without monitoring CPU usage directly?
CPU/GPU usage is one signal among many. ManySignal correlates: EC2 instance type changes to GPU or compute-optimized families, unexpected spot instance requests in large quantities, outbound connections to known mining pool IP ranges or domains (pool.minexmr.com, etc.), process names matching known miners (xmrig, cgminer, bfgminer, nheqminer), and unusual billing spikes in cost anomaly detection.
How quickly does cryptomining generate detectable signals?
Within minutes of a miner starting: outbound connections to mining pools are the fastest signal (detectable within 60 seconds via NetFlow or DNS logs). CPU/GPU metrics take longer to aggregate. ManySignal uses the network signal as the primary trigger and enriches with resource utilization data.
Does cryptomining detection cover Kubernetes workloads?
Yes. Cryptominers deployed as Kubernetes pods are detected via container image reputation checks (images pulled from unusual registries), resource limit overrides (mining containers often request unusually high CPU limits), and the same network connection analysis applied at the pod network level via Cilium or Calico flow logs.
Can cryptomining be confused with legitimate GPU or HPC workloads?
The key differentiator is the mining pool connection. Legitimate ML training, video processing, and HPC workloads don't connect to cryptocurrency mining pool endpoints. ManySignal's network signal specifically watches for connections to mining pool infrastructure, which provides a low-false-positive primary detection signal independent of CPU utilization.
Detect cryptojacking before it becomes a six-figure cloud bill
Mining pool network detection and GPU instance launch monitoring — real-time, not retroactive billing analysis.