cryptojacking
unauthorized miner on endpoint / cloud workload — CPU/GPU baseline drift + persistence + outbound pool traffic.
a guided path, not automation — each step opens a tool you run yourself; nothing uploads. progress is saved only in this browser.
wraps the cryptojacking — beacon kit preset — drop process + network + DNS logs → ancestry → beacon detect → DNS timeline → persistence → report
guided steps
- process ancestry reconstructor
reconstruct process parent-child chains for miner processes
- scheduled task deletion and history clearing detector
detect scheduled-task tampering for miner persistence
- registry autorun entry removal detector
detect autorun key removal — anti-forensics after miner install
- case report generator
draft a report identifying miner persistence + pool infrastructure
suggested options · title: cryptojacking — scope assessment
when you're done
export a run summary — a small JSON record of which steps you marked done, your notes, and a self-hash so the record can't be silently altered. it is your reproducibility note, not a per-tool receipt: each tool emits its own input→output receipt when you run it.