A customer is reviewing Container audits, and an audit has identified a cryptominer attack. Which three options could have generated this audit? (Choose three.)

Prisma Cloud Compute identifies cryptomining attacks by detecting anomalous behavior and matching known threat signatures. Key indicators include: a container exhibiting unusually high and sustained CPU usage over time; the presence of processes with names common to cryptomining software (e.g., xmrig); and network connections to known mining pools, which often use specific, non-standard ports. These three technical indicators are actively monitored by the runtime defense mechanisms to generate a cryptominer audit.

A. Prisma Cloud has no mechanism to determine the monetary value of mined currency; its detection is based on system and network behavior.
D. Associating mined currency with a specific user token is not a function of runtime container security and is not a detectable event within the container.

1. Palo Alto Networks, "Runtime defense for containers," Prisma Cloud Administrator's Guide (Compute). This section details how runtime models are built to detect anomalous behavior, including "Anomalous process activity" and "Anomalous network activity."

2. Palo Alto Networks, "Cryptojacking," Prisma Cloud Threat Research. This documentation often describes the Tactics, Techniques, and Procedures (TTPs) of cryptojacking, which include high CPU usage, specific process names, and network connections to mining pools. The product's runtime defense is built to detect these TTPs.

3. Palo Alto Networks, "Runtime policy rules," Prisma Cloud Administrator's Guide (Compute). The rules engine can be configured to detect suspicious processes and network connections, which are key components in identifying cryptominers.