Detecting Coin Miners with Palo Alto Networks NGFW

This post details how Expel detects and investigates cryptojacking incidents using Palo Alto Networks NGFW and automated Ruxie actions: it walks through a CoinMiner alert, netflow and PCAP evidence showing json-rpc traffic to a mining pool (example IP 45.9.148.21), and provides mitigations such as patching public apps, protecting cloud keys, and monitoring for json-rpc/mining-pool connections.