Is this skill useful for cost management?

Yes, by integrating with AWS Cost Anomaly Detection, it helps identify 'resource hijacking' early, preventing massive billing surprises from unauthorized compute usage.

How does it identify mining traffic?

It monitors VPC Flow Logs and DNS queries for the Stratum protocol and connections to known mining pool ports like 3333, 4444, 5555, and 8333.

What cloud providers does this skill support?

This skill primarily focuses on AWS (EC2, ECS, EKS) and Azure services, providing specific CLI commands and KQL queries for both platforms.

Can this skill automatically stop mining instances?

Yes, it includes workflows for auto-remediation, such as isolating instances via security groups and disabling API termination protection to remove malicious workloads.

Does it detect mining in Kubernetes or container environments?

Absolutely. It covers EKS and ECS runtime monitoring, scanning for common mining container images and suspicious process execution inside pods.

Cloud Cryptomining Detection & Response

Name: Cloud Cryptomining Detection & Response
Author: mukul975

bymukul975

•

4,121

•

Security & Testing

Detects and remediates unauthorized cryptocurrency mining operations across AWS and Azure cloud environments.

This skill empowers security teams and AI agents to identify resource hijacking and cryptojacking attacks by analyzing compute anomalies, network traffic patterns, and GuardDuty findings. It provides automated workflows for monitoring cost spikes, analyzing VPC flow logs for mining pool connections, and executing critical incident response steps like forensic snapshotting and instance isolation. It is an essential tool for SecOps teams looking to minimize financial impact and secure cloud workloads against unauthorized mining software like XMRig.

Key Features

01GuardDuty finding analysis for EC2, ECS, and EKS

02Runtime container security for hidden mining processes

03Automated incident containment and forensic isolation scripts

044,121 GitHub stars

05Automated cloud cost anomaly detection and alerting

06Network traffic monitoring for known mining pool protocols

Use Cases

01Investigating compromised IAM credentials used to launch mining instances

02Responding to unexpected cloud billing spikes caused by resource hijacking

03Monitoring containerized workloads for unauthorized background processes

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add mukul975/anthropic-cybersecurity-skills detecting-cryptomining-in-cloud

For use in Claude.ai and ChatGPT

Key Features

01GuardDuty finding analysis for EC2, ECS, and EKS

02Runtime container security for hidden mining processes

03Automated incident containment and forensic isolation scripts

044,121 GitHub stars

05Automated cloud cost anomaly detection and alerting

06Network traffic monitoring for known mining pool protocols

Use Cases

01Investigating compromised IAM credentials used to launch mining instances

02Responding to unexpected cloud billing spikes caused by resource hijacking

03Monitoring containerized workloads for unauthorized background processes

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add mukul975/anthropic-cybersecurity-skills detecting-cryptomining-in-cloud

For use in Claude.ai and ChatGPT