XMRig download-extract-execute chain via curl to /tmp hidden binary
Detects a multi-stage attack chain involving the download, extraction, permission modification, and execution of the XMRig cryptocurrency miner on Linux systems. The rule specifically monitors for common staging patterns in /tmp and the use of known mining-related CLI arguments.
Microsoft Sentinel (KQL)
