Family: xmrig

XMRig is a high performance, open source, cross platform CPU/GPU miner.

Windows security bypass

XMRig Miner payload

Detects executables containing artifacts associated with disabling Widnows Defender

Detects executables embedding registry key / value combination indicative of disabling Windows Defen

detects Windows exceutables potentially bypassing UAC using eventvwr.exe

Command and Scripting Interpreter: PowerShell

Run Powershell and hide display window.

Command and Scripting Interpreter: PowerShell

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

Modifies Windows Firewall