A customer is reviewing Container audits, and an audit has identified a cryptominer attack. Which three options could have generated this audit? (Choose three.)

Associating mined currency with a user token is a behavioral indicator that Prisma Cloud uses to identify cryptomining activity tied to a specific identity within the container.

Prisma Cloud does not use a monetary value threshold such as $100 to determine whether a cryptomining attack has occurred - detection is based on behavioral and network indicators, not financial metrics.

Sustained high CPU usage over time is a classic cryptominer behavioral signature that Prisma Cloud runtime defense monitors and flags as an anomaly.

Detection of port usage commonly associated with cryptomining pools is a network-based indicator that triggers a cryptominer audit in Prisma Cloud.

While process name detection is a capability of Prisma Cloud runtime defense, it is not listed among the specific criteria that generate a cryptominer container audit in this context.