ThreatFox: XMRIG IOCs

Hunt Hypothesis

This hunt detects adversary behavior involving the deployment of XMRIG cryptocurrency mining malware by identifying three specific indicators of compromise within network and host telemetry. A SOC team should proactively search for these IOCs in Azure Sentinel to uncover silent resource exhaustion attacks that often evade standard signature-based defenses while operating under legitimate user contexts.

IOC Summary

Malware Family: XMRIG Total IOCs: 3 IOC Types: domain, ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - XMRIG
let malicious_ips = dynamic(["5.189.149.171"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["5.189.149.171"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - XMRIG
let malicious_domains = dynamic(["endpoint.project0.cc"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — XMRIG

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: XMRIG IOCs rule in an enterprise environment, along with suggested filters or exclusions:

• DevOps and CI/CD Pipeline Execution

  • Scenario: Development teams frequently use Docker containers running xmrig (or similar mining binaries) within Kubernetes clusters to test high-performance computing workloads or validate crypto-related application logic. These instances often communicate with public block explorers or specific API endpoints that match the ThreatFox IOCs, triggering alerts during automated build and deployment cycles.
  • Suggested Filter: Exclude traffic originating from known DevOps subnets (e.g., 10.x.x.x/24) or specifically filter out processes running within container runtimes like containerd, dockerd, or kubelet where the executable path contains /var/lib/docker or /opt/k8s.

• IT Asset Management and Hardware Diagnostics

  • Scenario: System administrators utilize specialized hardware diagnostic tools (such as SolarWinds Server & Application Monitor, Lansweeper, or custom PowerShell scripts) that include xmrig modules to benchmark CPU/GPU performance across the fleet. These scheduled jobs run nightly on endpoint agents, generating network connections to the same IOCs identified in the rule while performing resource stress tests.
  • Suggested Filter: Create an exclusion for processes launched by known management service accounts (e.g., svc_lansweeper, svc_solarwinds) or filter based on scheduled task names containing keywords like “Hardware_Benchmark,” “Stress_Test,” or “Asset_Discovery.”

• Software Development and Local Build Environments

  • Scenario: Software engineers working on blockchain applications, high-frequency trading platforms, or data science projects often run xmrig locally to simulate mining environments or test