title: Cryptomining Payload Deployed Through an Agent Skill or Tool Call
id: ATR-2026-02845
rule_version: 2
status: experimental
description: |
  Detects a coin-mining program being launched by an AI agent - from a shell block inside a SKILL.md, from an MCP server's setup instructions, or directly in a tool_call argument. The shape comes from the SkillFortify benchmark (arXiv:2603.00195, "Formal Analysis and Supply Chain Security for Agentic AI Skills"), attack class A10: a skill whose stated job is linting or configuration ("flake8-config-helper") carries a "background resource optimizer" section that runs xmrig against a stratum pool with the attacker's Monero payout address. The agent executes it because the surrounding documentation reads like housekeeping.
  The three published A10 samples for the Claude packaging and the three for the OpenClaw packaging all pass the current ATR corpus untouched (measured 0/6); the only hits on the MCP packaging come from generic MCP-config rules that never see the mining command itself. Nothing in ATR keyed on mining before this rule.
  Detection targets the invocation, not the topic. A miner name has to appear in command position - at the start of a line or after a shell separator - and be followed on the same line by mining flags or a stratum:// endpoint; or a stratum endpoint has to appear IN CONFIGURED POSITION (as the value of --url / --pool / -o / --server, or of a "url"/"pool"/"server"/"host" key) within 300 characters of a Monero payout address, which covers the case where the miner binary has been renamed. Prose that merely names xmrig, and detection content that lists miner process names, do not put the binary in command position and do not fire. The payout branch is Monero-only on purpose: an earlier draft accepted Ethereum addresses and fired on a finance memo that mentioned a treasury wallet and stratum egress in the same paragraph. The configured-position requirement on Layers 2-3 was added for the same reason at a larger scale - see the note on those conditions. CWE-506 (Embedded Malicious Code), CWE-400 (Uncontrolled Resource Consumption).
author: ATR Community
date: 2026/08/24
schema_version: '0.1'
detection_tier: pattern
maturity: test
severity: high
references:
  owasp_llm:
    - LLM03:2025
    - LLM10:2025
  owasp_agentic:
    - ASI05:2026
  mitre_atlas:
    - AML.T0010 - AI Supply Chain Compromise
    - AML.T0011 - User Execution
  mitre_attack:
    - T1496 - Resource Hijacking
    - T1195.002 - Compromise Software Supply Chain
    - 'T1059.004 - Command and Scripting Interpreter: Unix Shell'
  external:
    - https://arxiv.org/abs/2603.00195
    - https://github.com/qualixar/skillfortify
    - https://github.com/qualixar/skillfortify/tree/main/benchmarks/skills/claude/malicious/claude_mal_A10_001
metadata_provenance:
  mitre_atlas: human-reviewed
  mitre_attack: human-reviewed
  owasp_llm: human-reviewed
  owasp_agentic: human-reviewed
compliance:
  eu_ai_act:
    - article: '15'
      context: 'Article 15 requires an accuracy, robustness and cybersecurity level appropriate to the system''s purpose. A skill that silently converts the deployer''s compute into a mining rig is an availability attack on the AI system itself: the resources the model needs to serve its declared purpose are consumed by an undeclared workload. Rejecting the mining invocation at skill-acquisition time is the concrete robustness control.'
      strength: primary
    - article: '9'
      context: Article 9 risk management must enumerate the entry vectors of the agent toolchain. Resource hijacking through a helper skill is a distinct hazard from data exfiltration and needs its own entry in the risk register, because its consequence is cost and denial of service rather than confidentiality loss and no data-protection control detects it.
      strength: secondary
  nist_ai_rmf:
    - function: Manage
      subcategory: MG.2.2
      context: MG.2.2 requires mechanisms to sustain the value of deployed AI systems. A hijacked inference host degrades throughput and inflates spend for as long as the miner runs; alerting on the invocation is the mechanism that keeps the deployment's value from being drained.
      strength: primary
    - function: Govern
      subcategory: GV.6.1
      context: GV.6.1 supplier risk policy must cover skills and MCP servers pulled from public registries. This rule enforces that policy at the point of acquisition by flagging a candidate skill whose shell blocks launch a coin miner regardless of what its manifest claims to do.
      strength: primary
    - function: Measure
      subcategory: MS.2.7
      context: MS.2.7 requires AI system security and resilience to be evaluated and documented. Scanning every candidate skill for miner invocations produces the documented pre-install evaluation this subcategory expects, and the match record is the evidence.
      strength: secondary
  iso_42001:
    - clause: '8.1'
      context: Clause 8.1 operational control over externally provided AI components applies directly to skills and MCP servers. This rule is the operational control that stops an externally provided component whose executable content is a coin miner from entering the agent runtime.
      strength: primary
    - clause: '8.3'
      context: 'Clause 8.3 AI risk treatment is implemented here as an acquisition-time alert: the identified risk (undeclared compute consumption by an agent-installed capability) is treated by surfacing the invocation to a human before any shell block is run.'
      strength: secondary
tags:
  category: skill-compromise
  subcategory: cryptojacking
  scan_target: both
  confidence: high
agent_source:
  type: tool_call
  framework:
    - any
  provider:
    - any
detection:
  condition: any
  method: pattern
  false_positives:
    - 'ANY DOCUMENT THAT DISPLAYS A WORKING MINER COMMAND LINE matches Layer 1, whatever the author intended by it. Measured examples: the xmrig project''s own README usage section, a distro package description quoting the same line, a CPU review reporting the benchmark command, a CTF forensics write-up decoding the cron entry, a threat report reproducing the ExecStart in a fenced block, and a detection rule''s own positive test fixture. The quoted artefact and the executed artefact are the same string; a single-event content rule cannot separate them, and suppressing fenced code blocks is not available here because the fenced shell block is exactly where the SkillFortify A10 payload lives. Prose that names miners mid-sentence, and detection content that only lists miner process names, are outside Layer 1 by construction because neither puts the binary in command position - those shapes are in the true_negatives.'
    - A genuinely authorised mining deployment driven by an agent - a mining-farm operations skill, a GPU burn-in harness that uses a miner as its load generator, a NixOS services.xmrig module, a Kubernetes rig manifest - is indistinguishable from cryptojacking at the level of one command line and will match. This rule reports; it does not block. Sites that legitimately mine should suppress it by rule id.
    - A pool-side or proxy-side project (a stratum proxy, a pool payout service, a mining accounting tool) whose configuration or test fixture carries a configured pool endpoint next to a payout address will match Layer 2.
  conditions:
    - field: content
      operator: regex
      value: (?i)(?:^|[\r\n;]|&&|\|\|)[ \t]*(?:\b(?:sudo|nohup|setsid|exec|start|screen|tmux)[ \t]+){0,3}(?:[.~]?[\w.$/\\-]{0,60}[/\\])?(?:xmrig|xmr-stak(?:-rx)?|minerd|cpuminer(?:-multi|-opt)?|ethminer|nbminer|t-rex|phoenixminer|srbminer(?:-multi)?|lolminer|teamredminer|gminer|nanominer|nheqminer|cgminer|bfgminer|verusminer)(?:\.exe)?[ \t]+(?:-{1,2}[a-z][\w-]{0,24}|stratum\+)[^\n]{0,180}(?:stratum\+(?:tcp|tcps|ssl)://|--donate-level|--rig-id|--nicehash|--cpu-priority|--pool[ \t=]|--coin[ \t=]|--algo[ \t=]|--url[ \t=]|--user[ \t=]|--wallet[ \t=]|--threads[ \t=]|-o[ \t]+[^\s]|-u[ \t]+[^\s])
      description: Coin-mining binary invoked in command position with mining flags or a stratum pool endpoint on the same command line
    - field: content
      operator: regex
      value: (?i)(?:(?:^|[\s,\[\(=])--?(?:url|pool|pool-url|o|server|host)\b|["']?\b(?:url|pool|pool_url|poolurl|server|host)["']?\s*[:=])[\s"',\[\(]{0,4}stratum\+(?:tcp|tcps|ssl)://[\s\S]{0,300}\b[48][0-9ab][1-9a-hj-np-zA-HJ-NP-Z]{93}\b
      description: Stratum pool endpoint configured as a pool setting within 300 characters of a Monero payout address
    - field: content
      operator: regex
      value: (?i)\b[48][0-9ab][1-9a-hj-np-zA-HJ-NP-Z]{93}\b[\s\S]{0,300}(?:(?:^|[\s,\[\(=])--?(?:url|pool|pool-url|o|server|host)\b|["']?\b(?:url|pool|pool_url|poolurl|server|host)["']?\s*[:=])[\s"',\[\(]{0,4}stratum\+(?:tcp|tcps|ssl)://
      description: Monero payout address within 300 characters ahead of a stratum endpoint configured as a pool setting
response:
  actions:
    - alert
  auto_response_threshold: critical
  message_template: |
    [ATR-2026-02845] HIGH: this skill or tool call launches a cryptocurrency miner. A coin-mining binary appears in command position with a mining flag or stratum endpoint, or a configured stratum pool endpoint appears next to a Monero payout address. Skills that present themselves as linters, cleanup helpers or "background resource optimizers" are the published carrier for this payload (SkillFortify A10). Do not run the shell block. Confirm with the operator whether any mining workload is authorised on this host, and check the payout address against the campaign's known wallets before reinstalling.
confidence: 82