Active Malware Remediation: Coin Miners

Jelan from Sophos Support goes over how to identify and remediate Coin Miner infections.






---------------------------------------------------------------------------------------------------------

Skip ahead to these sections:

0:00 Overview
0:34 Identify
2:49 Patching
3:39 Removal
5:57 Additional Information

PowerShell Commands: https://support.sophos.com/support/s/article/KB-000038535?language=en_US&c__displayLanguage=en_US

Sophos MTR Rapid Response: https://www.sophos.com/en-us/products/managed-threat-response/rapid-response.aspx

Sophos MTR self help guide document: https://docs.sophos.com/central/MTR/selfhelp/en-us/central/MTR/concepts/ActiveMalware.html

Autoruns: https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns

How to check Windows Updates: https://support.microsoft.com/en-us/help/4023262/how-to-verify-that-ms17-010-is-installed

Check for Eternal Blue vulnerability: https://support.sophos.com/support/s/article/KB-000038107?language=en_US