A command-line cryptominer is a cryptocurrency mining program run from a terminal or shell. It typically uses CPU, GPU or ASIC resources and may be started with scripted arguments, which makes it easy to automate and harder to notice than a graphical application.
What a command-line cryptominer is used for
A command-line cryptominer is usually deployed to turn a host into a mining worker with minimal user interaction. Because it can be launched from a shell, wrapped in scripts, or embedded in automation, it blends into legitimate administration workflows while still consuming the same compute resources that normal workloads need.
That operating model matters because the same traits that make it convenient for legitimate automation also make it attractive for abuse. A miner started from a terminal can run headless, persist through scheduled tasks, and look like routine process activity unless defenders are watching process creation, command history, and unusual resource usage.
Why command-line miners are hard to notice
Command-line execution reduces the visual cues that a graphical application would normally expose. On an endpoint or server, the process may appear as a short-lived launcher that spawns a longer-running worker, or it may be hidden inside a larger script chain that looks administrative at first glance.
This is why command-line miners often sit alongside broader living off the land tradecraft. The miner itself is not a built-in tool, but the delivery and execution pattern can still exploit the same trust defenders place in scripts, native utilities, and unattended automation.
When miners are launched through package scripts or build jobs, the execution context can also obscure the original source of the process. That makes the surrounding chain, not just the miner binary, important for investigation.
How command-line miners affect systems and identities
The direct impact is resource theft: CPU, GPU, power, and sometimes memory bandwidth are diverted away from the intended workload. On shared servers, that can degrade application performance, increase cloud spend, and trigger throttling or outages when capacity is already tight.
The identity angle becomes material when the miner arrives through a compromised account, token, or pipeline secret. In those cases, the miner is often a symptom of broader compromise, not the only payload. The same access used to place the miner may also expose deployment credentials, package-publishing rights, or other sensitive automation paths.
For example, a cryptominer introduced through a software distribution workflow often indicates that an attacker has already reached a trusted publishing boundary. NHIMG’s Rspack npm compromise 2024 and Ultralytics PyPI compromise 2024 show that a miner can be one visible consequence of a deeper trust failure in build or release automation.
What defenders look for in command-line cryptominer activity
Defenders usually look for process creation patterns, suspicious command-line arguments, unexpected parent-child process relationships, and sustained high compute use on hosts that should be mostly idle. On Windows, command-line logging is especially valuable because it captures the exact invocation that launched the miner.
Detection becomes stronger when command-line evidence is combined with network telemetry, since many miners need to reach mining pools or proxy services. A single suspicious shell command may be inconclusive, but repeated execution plus outbound connections and resource spikes is a strong indicator that the host is mining.
Audit logging also helps separate legitimate admin use from abuse. The CIS Control 8 Audit Log Management Guide is useful here because command-line auditing, centralized collection, and review discipline are what make short-lived execution visible enough to investigate.
Why the cryptomining angle matters for incident response
Command-line cryptominers are often treated as nuisance malware, but they can be an early sign of foothold, lateral movement, or stolen credentials. If a miner is present, responders should assume the environment may also contain additional payloads, persistence, or exposed secrets.
That is why malware analysis remains relevant even when the immediate symptom is “just mining.” NHIMG’s Malware Guide provides the broader context for classifying the delivery, persistence, and evasion patterns that frequently accompany cryptominers, especially when they are used as a low-noise payload after initial access.
In practice, the response question is not only “how do we stop the miner?” but also “what access did the attacker use, what else could they have touched, and which secrets or accounts should be rotated after removal?”
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1059 — Command and Scripting Interpreter | Command-line miners execute through shell-driven command execution patterns. |
| T1053 — Scheduled Task/Job | Many command-line miners persist by automated task or job execution. | |
| Recommendation — Map miner launch commands to T1059 and hunt for suspicious script or shell execution paths. Review scheduled task and job creation for miner persistence and remove unauthorized launches. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | Command-line miners are easier to detect when process and command execution are logged centrally. |
| Recommendation — Enable and centralize command-line logging so miner execution can be detected and investigated. | ||
| NIST SP 800-53 Rev 5 | AU-12 — Audit Record Generation | Audit records are needed to capture the exact command used to start the miner. |
| SI-4 — System Monitoring | Miner activity is commonly found through abnormal resource use and process behavior. | |
| Recommendation — Generate audit records for process creation and command-line activity across endpoints and servers. Monitor for sustained compute spikes and suspicious miner process behavior on production hosts. | ||
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 3, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org