alibabacloud-mining-attack-diagnosis

• Outcome: Review
• Latest audit: Oct 30, 2026 · 7:50 AM UTC
• Version: 0.0.2

Overview

This read-only cloud security skill needs review because it expands narrow requests into account-wide checks and can produce misleading security conclusions.

Select the intended read-only CLI profile explicitly: --account only labels the report. Protect saved reports because they contain infrastructure details. Until time filtering and failed-query conclusions are corrected, independently verify the queried period and successful retrieval before trusting a clean result or following remediation advice.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (14)

YARA rule 'crypto_miner_software': References to known cryptocurrency mining software [cryptominers]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched cryptocurrency mining indicators (stratum protocol, mining pools, miner binaries, or cryptojacking scripts).

Content

Scanner excerpt · references/mining_indicators.md (reported line 21)May include surrounding context.

md

e (case-insensitive substring match):

### Chinese wording
See `MINING_ALERT_KEYWORDS` in `scripts/_constants.py` (the Chinese entries are
kept in the Python source for runtime matching against SAS alert text).

### English generic
`mining`, `miner`, `cryptomining`, `cryptojacking`, `coinminer`, `coin miner`,
`monero`, `stratum`, `mining pool`, `pool connection`

### Known miner families / tools
`xmrig`, `xmr-stak`, `minerd`, `cpuminer`, `ccminer`, `nbminer`,
`phoenixminer`, `kdevtmpfsi`, `kinsing`, `watchdogs`, `sysrv`, `wannamine`,
`photominer`, `lemon_duck` / `lemonduck`, `z0miner`, `teamtnt`, `8220`,
`outlaw`, `rocke`

## Relevant SAS Alert Types (`MINING_EVENT_TYPES`)

Mining commonly surfaces under these Security Center alert categories:

| Alert Type | Meaning | Mining relevance |
|------------|---------|------------------|
| Malicious script | Mining install/dropper scripts | Dropper / installer stage |
| Malicious process | The miner binary itself | Direct miner detection |
|

YARA rule 'crypto_miner_software': References to known cryptocurrency mining software [cryptominers]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched cryptocurrency mining indicators (stratum protocol, mining pools, miner binaries, or cryptojacking scripts).

Content

Scanner excerpt · scripts/_constants.py (reported line 27)May include surrounding context.

python

s intact).
MINING_ALERT_KEYWORDS = [
    # Chinese (escaped): wa-kuang / kuang-chi / kuang-ji / men-luo-bi / bi
    "\u6316\u77ff", "\u77ff\u6c60", "\u77ff\u673a", "\u95e8\u7f57\u5e01", "\u5e01",
    # English generic
    "mining", "miner", "cryptomining", "cryptojacking", "coinminer",
    "coin miner", "monero", "stratum", "mining pool", "pool connection",
    # Known miner families / tools
    "xmrig", "xmr-stak", "minerd", "cpuminer", "ccminer", "nbminer",
    "phoenixminer", "kdevtmpfsi", "kinsing", "watchdogs", "sysrv",
    "wannamine", "photominer", "lemon_duck", "lemonduck", "z0miner",
    "teamtnt", "8220", "outlaw", "rocke",
]

# SAS alert event TYPES that mining commonly manifests under. Used as a
# secondary signal (alongside MINING_ALERT_KEYWORDS) when classifying alerts.
# These are the human-readable AlarmEventType values SAS returns.
MINING_EVENT_TYPES = [
    # Chinese AlarmEventType values written as \uXXXX escapes (see note above).
    "\u6076\u610f\u811a\u672c",

YARA rule 'crypto_stratum_protocol': Stratum mining protocol usage (stratum+tcp/ssl, mining.subscribe/authorize) [cryptominers]

High

• Category: YARA Match
• Confidence: 90% confidence

Finding

YARA rule matched cryptocurrency mining indicators (stratum protocol, mining pools, miner binaries, or cryptojacking scripts).

Content

Scanner excerpt · references/module2_alert_detail_ioc.md (reported line 51)May include surrounding context.

needed for containment. Do not treat internal/private IPs as pool endpoints.

Aggregation

Across all detailed alerts, IOCs are de-duplicated and aggregated into a single IOC table for the report:

json

{
  "miningPoolIps": ["45.9.148.x"],
  "domains": ["pool.example-mining.tld"],
  "sampleMd5": ["<md5>"],
  "sampleSha256": ["<sha256>"],
  "processIndicators": ["/tmp/kdevtmpfsi", "xmrig -o stratum+tcp://..."],
  "matchedKeywords": ["xmrig", "stratum"]
}

Interpreting Results

• Pool IPs/domains present → active outbound mining traffic; attacker likely still controls the host. Highest urgency.
• Persistence indicators (cron, systemd, startup scripts, authorized_keys) in the process/command strings → will re-infect after a simple process kill; remove persistence before restoring service.
• Sample hash present → hunt the same hash across the fleet to find additional compromised hosts.

Standalone Script

bash

python scripts/query_alert_detai

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · references/module5_remediation_best_practices.md (reported line 72)May include surrounding context.

md

ses (23/73) experienced reinfection** because only
the process was killed without removing persistence or blocking the entry vector.

Cryptominers almost always install persistence and often a watchdog that
respawns the miner. The full persistence checklist:

- `cron` jobs (`/etc/cron*`, user crontabs, `/var/spool/cron/`)
- `systemd` units / timers
- `rc.local` / startup scripts (`/etc/rc.d/`)
- `LD_PRELOAD` entries (`/etc/ld.so.preload`)
- **`ld.so.preload` / shared-object hijack** (dynamic linker injection)
- **`/etc/init.d/` legacy scripts**
- **`.bashrc` / `.profile` / `/etc/profile.d/` shell-profile injection**
- **Rogue SSH `authorized_keys`** (attacker's public key)
- **Malicious Docker containers / Kubernetes DaemonSets**
- **Hidden users** (UID=0 pseudo-users in `/etc/passwd`)

Killing the process without removing ALL of the above, closing the entry
vulnerability, and blocking the pool endpoints leads to reinfection within
minutes. Follow the full Pre-P0 → P0 → P1 sequence

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/module5_remediation_best_practices.md (reported line 78)May include surrounding context.

md

- **`.bashrc` / `.profile` / `/etc/profile.d/` shell-profile injection**
- **Rogue SSH `authorized_keys`** (attacker's public key)
- **Malicious Docker containers / Kubernetes DaemonSets**
- **Hidden users** (UID=0 pseudo-users in `/etc/passwd`)

Killing the process without removing ALL of the above, closing the entry
vulnerability, and blocking the pool endpoints leads to reinfection within

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · scripts/mining_investigation.py (reported line 399)May include surrounding context.

python

p (ECS console -> Disks -> Snapshot) to preserve evidence. Do NOT create a custom image from the infected instance (it bakes in the malware). If SSH/RDP is blocked, use VNC remote access in the ECS console to log in.",
        "",
        "**Phase 2: Eradicate & Isolate**",
        "Kill the mining processes identified below, then remove ALL persistence: `cron` jobs, `systemd` units, `rc.local`, `/etc/init.d/`, `ld.so.preload`, `.bashrc`/`.profile` injections, and rogue SSH `authorized_keys`. Killing the process alone causes reinfection (~1/3 of real cases). Tighten the security group: restrict SSH(22)/RDP/database ports to your IP only, close unnecessary public ports (e.g. Redis 6379, Nacos 9997). Rotate all passwords: root, service accounts, database, RAM AccessKeys.",
        "",
        "**Phase 3: Harden**",
        "Enable or upgrade Security Center: activate anti-mining / malicious-process auto-quarantine. Patch the entry vulnerability flagged in Step 4 below (e.g. upgrade Nacos

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env, file_read, file_write, network, shell.

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Unrestricted Tool Access

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

md

** Step 1–4 API (`DescribeSuspEvents`, `DescribeAlarmEventDetail`, `DescribeSuspEventDetail`, `DescribeSecurityStatInfo`, `DescribeFieldStatistics`, `DescribeExposedInstanceList`, `DescribeVulList`) regardless of intermediate results, and auto-retries transient `ServiceUnavailable`/`Throttling`/`InternalError` responses — so you must **not** pre-empt or short-circuit it with ad-hoc calls.
2. **ABSOLUTE PROHIBITION (read-only enforcement):** Under **NO** circumstances may you generate, write, or execute any command/script calling a mutating API (`Update*`/`Delete*`/`Disable*`/`Modify*`/`Create*`/`Rotate*`/`Set*`/`Operate*`) — e.g. `OperateSuspiciousTargetBatch`, `ModifySecurityGroupRule`, `DeleteInstance`. This includes scripts "for the user to run manually". If the user asks to quarantine/kill/isolate, only output the manual remediation workflow and declare this skill is read-only.
3. **MANDATORY OUTPUT FORMAT:** When mining is confirmed, the report **MUST** start with the URGENT banne

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/_cli.py (reported line 338)May include surrounding context.

python

cmd += [f"--{key}", str(value)]

    try:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout)
    except subprocess.TimeoutExpired:
        raise CliError(f"aliyun {product} {action} timed out after {timeout}s")

Both alert-detail requests force Chinese-language responses without a user-selectable language option.

Medium

• Category: Output Handling
• Confidence: 94% confidence

Finding

Both API request payloads hard-code "Lang": "zh", imposing Chinese on returned alert details regardless of the user's language preference. The script provides no language option or documented justification for this restriction.

Content

No source excerpt is available for this finding.

Vulnerability queries force Chinese-language results without user opt-in.

Medium

• Category: Output Handling
• Confidence: 96% confidence

Finding

The request hardcodes "Lang": "zh", forcing Chinese localization for vulnerability results regardless of the user's language preference. No language option or justification for this restriction is provided.

Content

No source excerpt is available for this finding.

The documented --days lookback window is never enforced.

Medium

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

The script accepts --days but never passes it into collection or applies a timestamp filter, while reporting results as belonging to the requested window. This undermines incident-report integrity: historical alerts may be treated as current, and unbounded retrieval can exhaust pagination limits before the intended window is fully covered.

Content

No source excerpt is available for this finding.

The trigger list includes broad terms such as "mining", "miner", "risk assessment", and "remediation" without requiring a cryptojacking context.

Low

• Category: Trigger Abuse
• Confidence: 94% confidence

Finding

Generic triggers such as 'risk assessment' and 'remediation' can route unrelated requests into this skill. Combined with mandatory full investigation and automatic account selection, this can cause unintended authenticated cloud queries and disclosure of account security information in reports, even though the cloud operations are read-only.

Content

No source excerpt is available for this finding.

The API request forces Chinese-language alert content without user opt-in.

Low

• Category: Output Handling
• Confidence: 91% confidence

Finding

The hard-coded Lang: "zh" parameter requests Chinese-language alert fields, which are subsequently included in the script's output. The file provides neither a language-selection option nor a documented justification for enforcing this locale.

Content

No source excerpt is available for this finding.