ThreatFox: XMRIG IOCs | SOC Hunt Feed

Hunt Hypothesis

This hunt detects adversary behavior involving the deployment of XMRIG cryptocurrency mining software, characterized by specific indicators of compromise such as known malicious hashes and network connections to mining pools. SOC teams should proactively search for these IOCs in Azure Sentinel to identify unauthorized resource consumption that may signal a compromised environment being leveraged for cryptojacking operations before significant performance degradation occurs.

IOC Summary

Malware Family: XMRIG Total IOCs: 24 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`111[.]229[.]114[.]105:6379`	payload_delivery	2026-06-29	80%
ip:port	`172[.]104[.]173[.]62:6379`	payload_delivery	2026-06-29	80%
ip:port	`23[.]234[.]72[.]111:6379`	payload_delivery	2026-06-29	80%
ip:port	`59[.]110[.]241[.]158:6379`	payload_delivery	2026-06-29	80%
ip:port	`95[.]182[.]96[.]193:6379`	payload_delivery	2026-06-29	80%
ip:port	`95[.]173[.]222[.]59:5432`	payload_delivery	2026-06-29	80%
ip:port	`3[.]129[.]187[.]38:5432`	payload_delivery	2026-06-29	80%
ip:port	`103[.]214[.]9[.]20:6379`	payload_delivery	2026-06-29	80%
ip:port	`116[.]162[.]216[.]223:6379`	payload_delivery	2026-06-29	80%
ip:port	`123[.]57[.]92[.]77:6379`	payload_delivery	2026-06-29	80%
ip:port	`134[.]122[.]1[.]61:6379`	payload_delivery	2026-06-29	80%
ip:port	`159[.]203[.]64[.]55:6379`	payload_delivery	2026-06-29	80%
ip:port	`159[.]89[.]172[.]54:6379`	payload_delivery	2026-06-29	80%
ip:port	`165[.]22[.]8[.]2:6379`	payload_delivery	2026-06-29	80%
ip:port	`188[.]166[.]154[.]126:6379`	payload_delivery	2026-06-29	80%
ip:port	`172[.]104[.]63[.]215:6379`	payload_delivery	2026-06-29	80%
ip:port	`174[.]138[.]39[.]122:6379`	payload_delivery	2026-06-29	80%
ip:port	`194[.]163[.]181[.]15:6379`	payload_delivery	2026-06-29	80%
ip:port	`213[.]136[.]84[.]163:6379`	payload_delivery	2026-06-29	80%
ip:port	`217[.]216[.]66[.]74:5432`	payload_delivery	2026-06-29	80%
ip:port	`185[.]76[.]9[.]35:5432`	payload_delivery	2026-06-29	80%
ip:port	`23[.]234[.]72[.]111:5432`	payload_delivery	2026-06-29	80%
ip:port	`139[.]59[.]67[.]197:5432`	payload_delivery	2026-06-29	80%
ip:port	`138[.]199[.]15[.]161:5432`	payload_delivery	2026-06-29	80%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - XMRIG
let malicious_ips = dynamic(["111.229.114.105", "165.22.8.2", "95.182.96.193", "172.104.63.215", "23.234.72.111", "116.162.216.223", "123.57.92.77", "95.173.222.59", "213.136.84.163", "59.110.241.158", "139.59.67.197", "134.122.1.61", "174.138.39.122", "159.89.172.54", "103.214.9.20", "172.104.173.62", "188.166.154.126", "3.129.187.38", "194.163.181.15", "159.203.64.55", "217.216.66.74", "185.76.9.35", "138.199.15.161"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["111.229.114.105", "165.22.8.2", "95.182.96.193", "172.104.63.215", "23.234.72.111", "116.162.216.223", "123.57.92.77", "95.173.222.59", "213.136.84.163", "59.110.241.158", "139.59.67.197", "134.122.1.61", "174.138.39.122", "159.89.172.54", "103.214.9.20", "172.104.173.62", "188.166.154.126", "3.129.187.38", "194.163.181.15", "159.203.64.55", "217.216.66.74", "185.76.9.35", "138.199.15.161"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — XMRIG

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: XMRIG IOCs detection rule, tailored for an enterprise environment where legitimate mining or resource-intensive processes may mimic XMRIG behavior:

Software Supply Chain & DevOps Build Agents
- Scenario: CI/CD pipelines (e.g., Jenkins, GitLab Runners) or container orchestration tools (Kubernetes nodes running dockerd) often spawn temporary worker containers that execute resource-intensive compilation tasks. These agents may download and execute legitimate binaries named xmrig or similar mining utilities as part of a custom build step to validate hardware performance or run stress tests on new infrastructure before deployment.
- Filter/Exclusion: Exclude network connections and process executions originating from known DevOps hostnames (e.g., *.jenkins.internal, gitlab-runner-*) and restrict the rule to exclude processes running under specific service accounts like svc-build-agent or within designated build namespaces.
IT Asset Management & Hardware Diagnostics
- Scenario: Enterprise asset management tools such as SolarWinds, ManageEngine, or custom PowerShell scripts scheduled via Task Scheduler may periodically deploy diagnostic agents to endpoints. These agents often utilize XMRIG binaries (or libraries) to benchmark CPU/GPU performance, validate thermal throttling, or test memory integrity across the fleet during off-hours maintenance windows.
- Filter/Exclusion: Create an exclusion based on the parent process being a known management tool (e.g., SolarWinds.Agent.exe, TaskSchedulerService) and filter for executions occurring only within defined maintenance windows (e.g., 02:00–04:00 UTC) or originating from the “System” user context.
Virtualization Host Optimization
- Scenario: Hypervisor hosts running VMware vSphere or **Microsoft Hyper-V