I realize this tread is for programming and other higher level operations that I know nothing about
BuuuuT;
As someone with experience with crypto miners running on company hardware (E.G. I work at a family business and have been semi-allowed to run crypto miners) I can only offer the knowledge I have for myself.
IDS is not stopping me. We are running a Cisco Meraki MX67 with the AMP and IDS/IPS and I tested with all Blocked Website Categories, full lists, not top sites, and I am still getting through.
TLS and SSL on public ports (80, 443, etc)
my other option was to just use a VPN, which would be far less likely, as it is very noticeable. Even with split tunnelling, there would be settings on the local device to find.
The best bet is to log traffic, and look for outliers; crypto miners will always contact the servers listed in it's configuration.
Also crypto mining on CPU would stress the L2/L3 cache.
re-reading OP, web based attacks are tough, I am not sure how they work; but there would be a consistent connection made to a static server.
here is a link to a pool based web mining script meant to be implemented on a webpage; to run on a persons computer when they visit the site. It is old a defunct, but it may help give you some insight into how they function.