zeek-cryptomining

https://github.com/jsiwek/zeek-cryptomining
10 45 9 0 Last Push 3/3/21, 3:33 AM

Zeek Package To Detect Cryptocurrency (Bitcoin) Mining

This script/package for Zeek can detect Bitcoin, Litecoin, PPCoin, or other cryptocurrency mining traffic that uses getwork <https://en.bitcoin.it/wiki/Getwork>, getblocktemplate <https://en.bitcoin.it/wiki/Getblocktemplate>, or Stratum <http://mining.bitcoin.cz/stratum-mining/> mining protocols over TCP or HTTP. Note that the module cannot currently detect the Bitcoin P2P protocol, which is different from the mining protocols.

See mining.zeek for more details on how it works.

Installation

Via zkg:

zkg install jsiwek/zeek-cryptomining

Manually:

cd <prefix>/share/zeek/site
git clone https://github.com/jsiwek/zeek-cryptomining cryptomining
echo "@load cryptomining" >> local.zeek

Package Version :

Description :

Detects Bitcoin, Litecoin, or other cryptocurrency
mining traffic that uses getwork, getblocktemplate, or Stratum mining
protocols over TCP or HTTP. This package used to be named "bro_bitcoin".

Test Command :

cd testing && btest -d tests

Tags :

signatures, bitcoin, mining, cryptocurrency, cryptomining, cryptocoin