XMRig Monero Miner Binary with Stratum Protocol and CLI Flags
Detects Mach-O binaries embedding XMRig/Monero mining strings together with stratum mining protocol URIs and typical miner CLI flags, consistent with Monero miners dropped and executed as root following macOS Screen Sharing compromise.
YARA
