Does high CPU or GPU use prove cryptomining?¶

No. High CPU or GPU use does not by itself prove cryptomining.

Evidential caution: that unusual resource consumption must be malicious.

What this means¶

Legitimate causes include:

video rendering;

machine learning;

scientific analysis;

software compilation;

data processing;

gaming;

virtualisation;

backup;

security scanning.

which process consumed the resource;

what executable, script or container ran;

which account launched it;

what network connections existed;

whether mining-pool protocols or wallet identifiers were present;

whether the activity matched an approved workload;

what changed before utilisation increased.

A mining process may also be throttled deliberately and avoid obvious peaks.

Likewise, a process name may be renamed or disguised.

The strongest conclusion links resource consumption to a known mining workload or pool communication.

Where utilisation is intermittent, correlate the peaks with process start, network contact and scheduled activity. A miner may pause when users are active or vary intensity to reduce detection. Short monitoring windows may therefore miss or misrepresent the workload.

Cloud billing can provide another indicator, but cost alone is not proof. Price changes, legitimate scaling and provider credits can distort the picture. Link the billed resource to the actual process, image, container or function that consumed it.

Treat high utilisation as a trigger for investigation, and prove mining from process, network, account and workload evidence rather than resource use alone.

================================================================================

What to check or do next¶

• Investigators should establish:
• Preserve process lineage, command lines, memory where appropriate, network destinations, deployment records and cloud billing.
• Record that distinction explicitly. The operational takeaway is:

Evidential limits¶

The absence of extreme utilisation does not exclude mining.