# Cryptominer Indicators in Agent Content

- **Severity:** High
- **Signature ID:** `99c0d1e2-f3a4-4b56-7890-c1d2e3f4a5b6`
- **MITRE ATLAS:** AML.T0048 (External Harms)
- **OWASP:** ASI07 (Unsafe Autonomous Code Execution)

## Summary

This detection flags text, files, or output handled by an AI agent that contain signs of cryptocurrency mining: mining protocol traffic, known mining pool addresses, mining software names, or scripts that mine cryptocurrency in a browser. It suggests someone is trying to plant or run cryptomining code through the agent rather than for its intended purpose.

## How the attack works

An attacker gets content into an agent's workflow, such as a generated file, a fetched webpage, or a message the agent processes, that contains mining-related material. This can include the stratum protocol used to talk to mining pools, hostnames of known mining pools, references to mining software, or a browser-based cryptojacking script meant to run on a visitor's machine. The rule looks for these known patterns to catch an attempt to smuggle mining activity into agent-generated or agent-processed content. It does not by itself confirm that mining ran, only that the telltale markers appeared.

## Why it matters

If unnoticed, this can lead to unauthorized use of computing resources for someone else's cryptocurrency mining, higher cloud or infrastructure costs, and in the browser-script case, visitors' machines being hijacked to mine on the attacker's behalf.

## What you can do

- Review any flagged content manually before it is deployed, published, or executed to confirm whether the mining reference is legitimate.
- If you run blockchain or mining-related tooling that legitimately references pool URLs, document and allowlist those specific hostnames to reduce noise.
- Restrict agents from writing directly to production web pages, scripts, or executable outputs without human review.
- Monitor outbound network connections from systems running agent output for stratum protocol traffic or connections to known mining pool hosts.

## Known benign look-alikes

- Legitimate cryptocurrency pool operators managing their own infrastructure
- Blockchain developer tools referencing pool URLs in configuration

---
Source: https://www.netzilo.com/threats/cryptominer-detection