ThreatFox: XMRIG IOCs

Hunt Hypothesis

This rule detects the presence of known XMRIG indicators, signaling that an adversary has likely deployed a Monero cryptocurrency miner to exploit compute resources for financial gain. Proactively hunting for these IOCs in Azure Sentinel allows the SOC team to identify and isolate compromised workloads before the miner can fully saturate CPU resources or establish persistence mechanisms.

IOC Summary

Malware Family: XMRIG Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - XMRIG
let malicious_ips = dynamic(["46.8.228.191", "216.9.226.120"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["46.8.228.191", "216.9.226.120"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — XMRIG

False Positive Guidance

• Scenario: A DevOps engineer manually downloads the xmrig binary to a staging server to benchmark CPU performance for a new microservice deployment, using the standard GitHub release URL or a known internal mirror.
  • Filter/Exclusion: Exclude network connections or file creations where the source IP is within the internal 10.0.0.0/8 range and the user account belongs to the devops-benchmark security group, or exclude file paths ending in /benchmarks/ or /tmp/xmrig-test/.
• Scenario: An IT administrator runs a scheduled PowerShell script that pulls the latest XMRIG release from a trusted internal artifact repository (e.g., Artifactory or Nexus) to update a CI/CD pipeline’s build agent configuration, triggering the IOC match on the download URL or hash.
  • Filter/Exclusion: Exclude events where the parent process is powershell.exe or pwsh.exe and the command line contains specific flags like -File .\update-build-agent.ps1, or exclude network connections to the internal artifact repository domain (e.g., artifacts.corp.local).
• Scenario: A security team conducts a controlled red team exercise or chaos engineering test where they intentionally deploy XMRIG in an isolated test environment to validate detection coverage, using a unique user account sec-test-runner.
  • Filter/Exclusion: Exclude events where the user account is sec-test-runner or the host is tagged with the Azure/VM tag purpose=red-team-test, or exclude file executions where the working directory is /opt/red-team/xmrig/.
• Scenario: A legacy application update mechanism uses a generic downloader script that fetches dependencies from a public CDN, and the CDN’s path structure coincidentally matches one of the XMRIG IOCs (e.g., a shared library or dependency named