Skip to main content

8. How do you locate crypto‑mining malware during incident response? How do you trace the mining process to its associated file?

  1. Use Task Manager or netstat -anp to find abnormal PID and port.
  2. Locate file: cd /proc/PID and ls -l. Disable suspicious services.
  3. On Windows, wmic can analyse process parameters.