Function is_miner_cmdline 

pub fn is_miner_cmdline(cmdline: &ProcessCmdline) -> bool

Returns true if this cmdline looks like a cryptominer.

Matches when the executable contains "xmrig" or the arguments contain "stratum+" or "--pool".