Natriom

Чтоб не было создания велосипедов.

По поводу детектирования. Есть статья на сайте МС под названием

Defending against cryptojacking with Microsoft Defender for Endpoint and Intel TDT

Приведу цитату

Intel TDT applies machine learning to low-level hardware telemetry sourced directly from the CPU performance monitoring unit (PMU) to detect the malware code execution “fingerprint” at runtime with minimal overhead.
....
This technology is based on telemetry signals coming directly from the PMU, the unit that records low-level information about performance and microarchitectural execution characteristics of instructions processed by the CPU. Coin miners make heavy use of repeated mathematical operations and this activity is recorded by the PMU, which triggers a signal when a certain usage threshold is reached.

Вот почитай что такое Intel TDT, PMU e.t.c. Я думаю это будет правильное направление куда дальше искать.