Script for identify and find crypto miners in OS

check_crypto.sh

@@ -0,0 +1,42 @@
+#!/bin/bash
+#########################################################################
+#                         Script for finding miners                     #
+#                       Created by Pavol Macko - DoIT                   #
+#########################################################################
+clear
+echo "------------------------------------------------------------------"
+echo -e "- \e[1;32mChecking\e[0m process with \e[1;33mhigh\e[0m CPU"
+echo "------------------------------------------------------------------"
+ps -eo pid,user,%cpu,%mem,cmd --sort=-%cpu | head -10
+echo "------------------------------------------------------------------"
+echo -e "- \e[1;32mFinding\e[0m running \e[1;33mminers\e[0m process"
+echo "------------------------------------------------------------------"
+ps aux | grep -Ei \
+'xmrig|minerd|cpuminer|cgminer|bfgminer|nbminer|phoenixminer|trex|nanominer|lolminer|teamredminer' \
+| grep -v grep
+echo "------------------------------------------------------------------"
+echo -e "- \e[1;32mFinding\e[0m temporary \e[1;33mminers\e[0m process"
+echo "------------------------------------------------------------------"
+ps -eo pid,cmd | grep -E '/tmp|/dev/shm' | grep -v grep
+echo "------------------------------------------------------------------"
+echo -e "- \e[1;32mFinding\e[0m connection \e[1;33mminers\e[0m ports"
+echo "------------------------------------------------------------------"
+ss -tupn 2>/dev/null | grep -E ':1012|:3333|:4444|:5555|:6666|:7777|:8888|:9999|:14444|:14433'
+echo "------------------------------------------------------------------"
+echo -e "- \e[1;32mFinding\e[0m binary \e[1;33mminers\e[0m file"
+echo "------------------------------------------------------------------"
+find / -type f 2>/dev/null | grep -Ei \
+'xmrig|minerd|cpuminer|cgminer|bfgminer|nbminer|phoenixminer|trex|nanominer|lolminer|teamredminer' | head -10
+echo "------------------------------------------------------------------"
+echo -e "- \e[1;32mFinding\e[0m cron \e[1;33mminers\e[0m schedulers"
+echo "------------------------------------------------------------------"
+for user in $(cut -f1 -d: /etc/passwd);
+do
+	crontab -u "$user" -l 2>/dev/null
+done
+echo "------------------------------------------------------------------"
+echo -e "- \e[1;32mFinding\e[0m systemd \e[1;33mminers\e[0m services"
+echo "------------------------------------------------------------------"
+systemctl list-unit-files --type=service 2>/dev/null | \
+grep -Ei 'xmrig|miner|crypto|mining'
+echo "------------------------------------------------------------------"