Detect it by alerting on persistent high CPU or GPU usage, miner-like processes, and outbound connections to mining pools or relay infrastructure. Inspect process trees for scripts, scheduled tasks, or services that launch from user-writable paths, and check for dropped binaries or browser abuse. Correlate telemetry with power, thermal, and network anomalies to separate mining from normal workload spikes.
What to look for first on a Windows endpoint
Cryptomining on Windows is usually most visible as a resource and execution pattern, not as a single unique file name. Look for sustained CPU or GPU pressure, background processes that stay active when user activity is low, and command lines that resolve to miners, scripts, or launchers rather than ordinary productivity software. A process that keeps reappearing after termination is especially important.
The strongest signal comes when performance symptoms line up with process ancestry and persistence. Mining often starts from a browser, script host, archive extractor, or a dropper that writes into a user-writable location, then hands off to a child process or service that survives logoff. That pattern is what separates cryptomining from a legitimate workload spike.
For broader malware context, the Malware Guide is useful because cryptominers often reuse the same loader, persistence, and evasion patterns as other Windows malware families.
Which telemetry most often confirms mining behavior?
Network telemetry is usually the next best discriminator. Mining clients commonly maintain persistent outbound connections to pool infrastructure, relay servers, or proxy layers that are unusual for the host role. If the endpoint is also showing repeated DNS lookups, blocked connections, or beacon-like traffic to unfamiliar domains, the mining hypothesis becomes much stronger.
Endpoint telemetry should also be checked for indicators that explain how the miner started. Scheduled tasks, services, Run keys, WMI subscriptions, startup-folder entries, and browser extensions can all provide persistence. Review process trees for LOLBin-style execution, PowerShell, script hosts, archive utilities, and unsigned binaries launched from temp, app data, downloads, or other user-writable paths.
Be careful not to overfit on a single symptom. High resource use can come from rendering, analytics, compilation, backup jobs, or EDR scanning. What matters is the combination of sustained load, suspicious ancestry, persistence, and outbound mining-related traffic. On Windows, that combination is usually more reliable than any one indicator alone.
Endpoint hardening helps reduce what you need to chase. The Windows Endpoint Hardening Guide is a useful companion because controls such as Attack Surface Reduction rules, tamper protection, and exploit mitigation can reduce common miner launch paths.
How do you distinguish cryptomining from normal spikes and browser abuse?
Separate mining from benign workload peaks by correlating technical and environmental signals. Legitimate spikes usually map to a known business process, a user action, or a scheduled job, and they tend to start and stop in a predictable way. Mining often persists across idle periods, reappears after process termination, and shows little relation to interactive use.
Browser abuse is worth checking because some miners hide in browser processes, malicious extensions, or injected scripts. In that case, browser CPU use may stay elevated even when no heavy site is open, and the browser may spawn child processes or network sessions that do not match normal web activity. Dropped binaries, unusual extension installation, and repeated script execution from cache or profile paths are common clues.
Thermal, power, and fan telemetry can be very helpful when available. A workstation that remains hot, noisy, and power-hungry outside expected activity windows, especially while network traffic points to pool infrastructure, deserves immediate inspection. Correlating these signals helps avoid mistaking mining for a short-lived spike caused by a legitimate workload.
Risk and Threat Considerations
Cryptomining is not only a performance problem, it is often a sign that an attacker has achieved execution on the endpoint and is monetising access. That makes it an exposure question as much as a cleanup question, because the same foothold used for mining can later support credential theft, lateral movement, or additional malware.
Failure mechanism: Attackers commonly drop a miner, persistence mechanism, and relay configuration after initial compromise, then tune it to avoid obvious user-facing disruption while consuming enough host resources to be profitable.
Impact: The endpoint loses capacity, batteries drain faster, hardware degrades sooner, and the mining foothold may indicate broader compromise that requires investigation beyond the miner itself.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1496 — Resource Hijacking | Directly covers cryptomining as resource hijacking. |
| Recommendation — Map the activity to resource hijacking and hunt for the execution, persistence, and network path. | ||
| CIS Controls v8 | CIS-10 — Malware Defenses | Cryptomining is malware-like activity that needs detection and containment safeguards. |
| CIS-8 — Audit Log Management | Endpoint and network logs are needed to correlate process, persistence, and pool traffic. | |
| Recommendation — Use malware defenses to detect, isolate, and remove miner activity on endpoints. Centralise endpoint and network logs so miner activity can be correlated and investigated quickly. | ||
| NIST CSF 2.0 | DE.CM-01 — Monitors networks and endpoints to detect potential cybersecurity events | Detection depends on endpoint, process, and network monitoring for abnormal mining behaviour. |
| DE.AE-03 — Potential adverse events are analyzed to better understand attacks | Suspicious CPU, persistence, and pool traffic must be analyzed together to confirm mining. | |
| Recommendation — Monitor endpoint and network telemetry for sustained resource abuse and suspicious outbound connections. Analyze correlated host, power, and network anomalies to validate cryptomining activity. | ||
Practitioner Guidance
What to verify: Confirm whether the suspected process tree is tied to a known business workload, then verify persistence points, network destinations, and parent-child process relationships before assuming the miner is standalone. A miner with no persistence may be contained differently from one that reinfects on reboot.
What to prioritise: If the host is actively communicating with mining pools or the miner is launched from a user-writable path with persistence, treat it as an incident and assess for additional payloads, staged scripts, or credential exposure. Do not stop at killing the process if the launch mechanism remains intact.
Practitioner takeaway: The best detections combine resource anomalies with provenance and network context, because that is what turns “the machine is slow” into a defensible finding of cryptomining activity.
Related resources from NHI Mgmt Group
- How should security teams detect LodaRAT activity on Windows endpoints before the malware fully settles in?
- How should security teams detect ransomware activity from file creation and shadow copy deletion on Windows endpoints?
- How do you detect China Chopper web shell activity on Windows servers?
- How do you detect web shell activity on Windows servers?