Çözüldü Bilgisayarda mining virüsü olup olmadığı nasıl anlaşılır?

rule bitcoin {
    meta:
        author = "x0r"
        description = "Perform crypto currency mining"
    version = "0.1"
    strings:
        $f1 = "OpenCL.dll" nocase
        $f2 = "nvcuda.dll" nocase
        $f3 = "opengl32.dll" nocase
        $s1 = "cpuminer 2.2.2X-Mining-Extensions"
        $s2 = "cpuminer 2.2.3X-Mining-Extensions"
        $s3 = "Ufasoft bitcoin-miner/0.20"
        $s4 = "bitcoin" nocase
        $s5 = "stratum" nocase
    condition:
        1 of ($f*) and 1 of ($s*)
}
rule crypto_miner
{
    meta:
    author= "Brian Laskowski"
    info= " Detected a cryptomining exe"

    strings:
        $miner = "stratum+tcp"
   
    condition:
        $miner
}
// CoinMiner 1 işe yaramıyor 2.si kadar ama yine de koyayım
rule MALWARE_Win_CoinMiner01 {
    meta:
        author = "ditekSHen"
        description = "Detects coinmining malware"
    strings:
        $s1 = "-o pool." ascii wide
        $s2 = "--cpu-max-threads-hint" ascii wide
        $s3 = "-P stratum" ascii wide
        $s4 = "--farm-retries" ascii wide
        $dl = "github.com/ethereum-mining/ethminer/releases/download" ascii wide
    condition:
        uint16(0) == 0x5a4d and (3 of ($s*) or ($dl))
}
rule MALWARE_Win_CoinMiner02 {
    meta:
        author = "ditekSHen"
        description = "Detects coinmining malware"
    strings:
        $s1 = "%s/%s (Windows NT %lu.%lu" fullword ascii
        $s2 = "\\Microsoft\\Libs\\WR64.sys" wide
        $s3 = "\\\\.\\WinRing0_" wide
        $s4 = "pool_wallet" ascii
        $s5 = "cryptonight" ascii
        $s6 = "mining.submit" ascii
        $c1 = "stratum+ssl://" ascii
        $c2 = "daemon+http://" ascii
        $c3 = "stratum+tcp://" ascii
        $c4 = "socks5://" ascii
        $c5 = "losedaemon+https://" ascii
    condition:
        uint16(0) == 0x5a4d and (3 of ($s*) and 1 of ($c*))
       
}
//3331 ile başlayan en etkilisi
rule MacOS_Cryptominer_Generic_d3f68e29 {
    meta:
        author = "Elastic Security"
        id = "d3f68e29-830d-4d40-a285-ac29aed732fa"
        fingerprint = "733dadf5a09f4972629f331682fca167ebf9a438004cb686d032f69e32971bd4"
        creation_date = "2021-09-30"
        last_modified = "2021-10-25"
        threat_name = "MacOS.Cryptominer.Generic"
        reference_sample = "d9c78c822dfd29a1d9b1909bf95cab2a9550903e8f5f178edeb7a5a80129fbdb"
        severity = 100
        arch_context = "x86"
        scan_context = "file, memory"
        license = "Elastic License v2"
        os = "macos"
    strings:
        $a1 = "command line argument. See 'ethminer -H misc' for details." ascii fullword
        $a2 = "Ethminer - GPU ethash miner" ascii fullword
        $a3 = "StratumClient"
    condition:
        all of them
}

rule MacOS_Cryptominer_Generic_333129b7 {
    meta:
        author = "Elastic Security"
        id = "333129b7-8137-4641-bd86-ebcf62257d7b"
        fingerprint = "baa9e777683d31c27170239752f162799a511bf40269a06a2eab8971fabb098a"
        creation_date = "2021-09-30"
        last_modified = "2021-10-25"
        threat_name = "MacOS.Cryptominer.Generic"
        reference_sample = "bf47d27351d6b0be0ffe1d6844e87fe8f4f4d33ea17b85c11907266d36e4b827"
        severity = 100
        arch_context = "x86"
        scan_context = "file, memory"
        license = "Elastic License v2"
        os = "macos"
    strings:
        $a = { 6D BF 81 55 D4 4C D4 19 4C 81 18 24 3C 14 3C 30 14 18 26 79 5F 35 5F 4C 35 26 }
    condition:
        all of them
}

rule MacOS_Cryptominer_Generic_365ecbb9 {
    meta:
        author = "Elastic Security"
        id = "365ecbb9-586e-4962-a5a8-05e871f54eff"
        fingerprint = "5ff82ab60f8d028c9e4d3dd95609f92cfec5f465c721d96947b490691d325484"
        creation_date = "2021-09-30"
        last_modified = "2021-10-25"
        threat_name = "MacOS.Cryptominer.Generic"
        reference_sample = "e2562251058123f86c52437e82ea9ff32aae5f5227183638bc8aa2bc1b4fd9cf"
        severity = 100
        arch_context = "x86"
        scan_context = "file, memory"
        license = "Elastic License v2"
        os = "macos"
    strings:
        $a = { 55 6E 6B 6E 6F 77 6E 20 6E 65 74 77 6F 72 6B 20 73 70 65 63 69 66 69 65 64 20 }
    condition:
        all of them
}

rule MacOS_Cryptominer_Generic_4e7d4488 {
    meta:
        author = "Elastic Security"
        id = "4e7d4488-2e0c-4c74-84f9-00da103e162a"
        fingerprint = "4e7f22e8084734aeded9b1202c30e6a170a6a38f2e486098b4027e239ffed2f6"
        creation_date = "2021-09-30"
        last_modified = "2021-10-25"
        threat_name = "MacOS.Cryptominer.Generic"
        reference_sample = "e2562251058123f86c52437e82ea9ff32aae5f5227183638bc8aa2bc1b4fd9cf"
        severity = 100
        arch_context = "x86"
        scan_context = "file, memory"
        license = "Elastic License v2"
        os = "macos"
    strings:
        $a = { 69 73 20 66 69 65 6C 64 20 74 6F 20 73 68 6F 77 20 6E 75 6D 62 65 72 20 6F 66 }
    condition:
        all of them
}

rule MacOS_Cryptominer_Xmrig_241780a1 {
    meta:
        author = "Elastic Security"
        id = "241780a1-ad50-4ded-b85a-26339ae5a632"
        fingerprint = "be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8"
        creation_date = "2021-09-30"
        last_modified = "2021-10-25"
        threat_name = "MacOS.Cryptominer.Xmrig"
        reference_sample = "2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f"
        severity = 100
        arch_context = "x86"
        scan_context = "file, memory"
        license = "Elastic License v2"
        os = "macos"
    strings:
        $a1 = "mining.set_target" ascii fullword
        $a2 = "XMRIG_HOSTNAME" ascii fullword
        $a3 = "Usage: xmrig [OPTIONS]" ascii fullword
        $a4 = "XMRIG_VERSION" ascii fullword
    condition:
        all of them
}