cpu-logind in /var/tmp Is XMRig: How a MonitorVPS Alert Caught a Cryptominer
If you found a process called cpu-logind running from /var/tmp with the command line "/var/tmp/cpu-logind -c config.json", it is an XMRig Monero cryptominer. Here is how MonitorVPS suspicious-path and resource anomaly detection caught it on a customer's server.