An enterprise network administrator concerned with the operation on its systems of software that contradicts policy should already employ some kind of security scanner software. Adding the known miners to that list of flagged software is the best recourse. Additionally, watching for outbound connections to the known DNS names for peer lookup or outbound connections on a certain few known ports could yield better results with less software impeding operation.
In short, they're just programs, and administrators should already have in place the tools and knowledge necessary to block the programs from running or detect that they are running.
For ethics, the general vibe in the community is mine only on hardware you own, but obviously, not everyone follows that.