How to catch crypto miners using syscall signatures