How to Detect a Hidden Cryptominer on a Windows Server

A hidden cryptocurrency miner is one of the quieter outcomes of a server compromise, which is exactly why it often goes unnoticed for weeks. The attacker's goal is to steal compute, so staying invisible is part of the business model. The AhsayCBS backup servers compromised in October 2026 were turned into miners that actively worked to evade the one tool most administrators reach for first, Task Manager. This guide walks through how to find a miner that is trying hard not to be found.

Start With the Symptoms, Not the Task Manager

The classic sign of a miner is a processor pinned near 100 percent with no legitimate workload to explain it. But modern miners assume you will look there. The AhsayCBS payload included a PowerShell script that stopped the mining service the moment Task Manager launched and restarted it when Task Manager closed, so the one window an administrator opens to investigate showed normal usage. Some variants go further and close Task Manager for you after a timeout.

The lesson is that an interactive, on-demand tool is the wrong instrument for catching something that watches for it. Prefer evidence that is collected continuously and reviewed out of band: performance counters scraped on a schedule, power or thermal telemetry from the hardware, and cloud or hypervisorHypervisor🌐Software that creates and manages virtual machines by allocating physical hardware resources among multiple guest operating systems. VMware ESXi is a Type 1 (bare-metal) hypervisor. CPU graphs that the malware on the guest cannot see or suppress. A server that runs hot overnight but looks idle whenever someone logs in is a strong tell.

Follow the Process Lineage

Miners have to run as a process, and that process has a parent. The most durable detection is not the CPU graph but the ancestry of what is running. In the AhsayCBS case the chain started when the backup service itself, `cbssvcX64.exe`, spawned `curl` and `certutil` to download payloads. A backup service has no business launching download utilities, and that parent-child relationship is anomalous regardless of what the child is named.

Enumerate running processes with their parent process IDs and command lines, using tooling that reads the live process table rather than the Task Manager UI. Look for:

• Service binaries spawning scripting hosts (`powershell.exe`, `wscript.exe`) or download tools (`curl`, `certutil`, `bitsadmin`).
• Processes with names that impersonate legitimate software but run from the wrong location. The AhsayCBS miner ran as `edge.exe` and installed itself through a renamed service manager called `msedge.exe`, neither launched from the real Microsoft Edge install path.
• Executables running out of temporary or user-writable directories such as `%TEMP%`.

Naming impersonation is common enough that the technique has its own name, process masqueradingProcess Masquerading🛡️A defensive-evasion technique in which malware names its running process to imitate a legitimate system process, such as a kernel worker thread or a font or time-sync daemon, so it blends into normal process listings. The StyleSmuggler implant used kworker, fc-cache and chronyd disguises., and the defense is the same every time: judge a process by its full path, its parent and its signature, not by the string in the name column.

Inspect Services and Persistence

A miner that wants to survive a reboot needs a persistence mechanism, and on Windows that is usually a service or a scheduled task. The AhsayCBS intruders created a service named `MicrosoftEdgeUpdateSvc`, deliberately close to the legitimate Edge update service, that launched the miner. Review the installed services and their binary paths, and flag any whose executable sits in a temporary folder, lacks a trusted signature, or points at a binary whose name does not match a service you deployed.

Scheduled tasks deserve the same scrutiny. A miner commonly registers a task to relaunch itself if the service is stopped. Export the task list and read what each task actually runs, not just its display name.

Check Outbound Network Connections

Mining only pays if the miner can reach a pool, so the one thing it cannot hide is that it talks to the outside world. Capture active connections with their owning process, and compare destinations against what the server legitimately needs. A backup server reaching a mining pool on an unusual high port is unmistakable; the AhsayCBS miner connected to a pool on port 8029. Network egress monitoring at the firewallFirewall🌐Security system that monitors and controls network traffic based on predetermined rules. is more trustworthy than host-based checks here, because it sits outside any evasion the compromised host can perform. This is one more reason egress filteringEgress Filtering🌐Restricting the outbound connections a system may make to an explicit list of required destinations, enforced at the network layer or through an egress proxy. It breaks payload downloads, mining-pool connections and callback channels, and turns an attacker's success signal into a detection event. and a default-deny outbound policy pay off, since a miner that cannot reach a pool is a miner that cannot earn.

Use Detection Content, Not Just Manual Checks

Everything above can be encoded so you are not hunting by hand every time. Huntress published Sigma rules for the AhsayCBS miner covering the anomalous service children, the fake Edge binary, the Task Manager-aware script and the vulnerable driver download. Sigma rules are vendor-neutral detection logic you can translate into your own SIEM or EDR queries. Running them against collected process-creation and service-installation logs turns a one-time investigation into a standing control.

Know When You Have Found More Than a Miner

A cryptominer is often a marker that something with far more access got in first. The AhsayCBS compromise ran attacker code as SYSTEM and loaded a vulnerable kernel driver, the technique explained in How BYOVD Attacks Use a Signed Driver to Reach the Windows Kernel. Once a kernel-level implant is in play, nothing the running operating system reports can be fully trusted, so a confirmed miner on a sensitive host warrants rebuilding from clean media rather than deleting the offending files. Treat the miner as the visible edge of an intrusion that reached the AhsayCBS Backup Server Exploitation event's worst case: full control of a Tier-0 machine.

The Takeaway

To find a miner that fights back, stop relying on the tool it is built to evade. Collect CPU and network evidence out of band, hunt on process lineageProcess Lineage🛡️The parent-child chain of processes on a host, showing which process launched which. Hunting on lineage catches exploitation because compromised services spawn children they never would in normal operation. and service persistence rather than process names, and watch outbound connections at a chokepoint the host cannot manipulate. Codify what you learn into detection rules so the next miner trips an alert instead of running for a month. And when you find one on a server that matters, ask what else got in, because the mining is rarely the point. The strategic case for watching these machines closely is in Why Your Backup Server Is a Tier-0 Target.