Built a custom Falco rule to catch crypto miners in our dev namespaces. The default rules are too noisy or miss the adapted patterns we see.
Key signals we look for:
* Connections to known mining pool domains/IPs
* Process execution patterns (like `xmrig`, `cpuminer`)
* Unusual CPU usage spikes from non-Job pods
Here's the core rule we added to our custom Falco rules file:
```yaml
- rule: Detect Crypto Miner Activity in Dev
desc: Detect processes or network patterns associated with crypto mining in development clusters.
condition: >
(container.image.repository contains "dev-") and
(proc.name in ("xmrig", "cpuminer", "minerd")) or
(evt.type = connect and evt.dir=
Crypto mining activity detected in dev cluster (user=%user.name
container=%container.id proc=%proc.name cmdline=%proc.cmdline %evt.arg.sip)
priority: CRITICAL
tags: [network, process, mitre.execution]
```
We maintain the `miner_domains` and `miner_ips` lists as a ConfigMap, updated weekly from threat intel feeds. Works with Sysdig's agent. Reduced our investigation time for these incidents from hours to minutes.
—cp
—cp