ThreatFox: XMRIG IOCs | SOC Hunt Feed

Hunt Hypothesis

This hunt targets adversary behavior involving the deployment of XMRIG cryptocurrency mining tools, which often serve as indicators of resource hijacking or post-exploitation persistence within cloud workloads. Proactively hunting for these specific IOCs in Azure Sentinel is critical to identify early-stage cryptojacking campaigns before they significantly degrade system performance and incur unexpected operational costs.

IOC Summary

Malware Family: XMRIG Total IOCs: 4 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`31[.]57[.]63[.]78:80`	payload_delivery	2026-07-03	100%
ip:port	`94[.]183[.]182[.]171:80`	payload_delivery	2026-07-03	100%
ip:port	`156[.]229[.]165[.]166:80`	payload_delivery	2026-07-03	100%
ip:port	`107[.]175[.]114[.]96:80`	payload_delivery	2026-07-03	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - XMRIG
let malicious_ips = dynamic(["31.57.63.78", "156.229.165.166", "94.183.182.171", "107.175.114.96"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["31.57.63.78", "156.229.165.166", "94.183.182.171", "107.175.114.96"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — XMRIG

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: XMRIG IOCs detection rule, along with suggested filters and exclusions tailored for an enterprise environment:

DevOps CI/CD Pipeline Execution
- Scenario: Automated build agents (e.g., Jenkins, GitLab Runners, or Azure DevOps) frequently download open-source binaries to compile applications. XMRIG is a common dependency in projects involving blockchain integration or high-performance computing modules, causing the detection engine to flag the legitimate xmrig executable during routine code builds and container image creation.
- Filter/Exclusion: Exclude network traffic and process execution originating from known CI/CD service accounts (e.g., svc-jenkins, gitlab-runner) or restrict the rule scope to exclude specific build server subnets (e.g., 10.x.y.z/24).
IT Asset Management & Software Inventory Scans
- Scenario: Enterprise endpoint management tools like Microsoft SCCM, Ivanti, or SolarWinds NPM perform scheduled scans to inventory installed software. These agents often download and execute temporary installers that include XMRIG as a background component for resource monitoring, triggering the IOC match when scanning developer workstations or engineering clusters.
- Filter/Exclusion: Create an exclusion based on the parent process name (e.g., ccmexec.exe, solarwinds-agent.exe) and exclude events where the XMRIG binary is located in temporary installation directories (e.g., %TEMP% or C:\ProgramData\Ivanti).
Scheduled Security Baseline Audits
- Scenario: During monthly security compliance audits, tools such as Tenable Nessus, Qualys, or Microsoft Defender for Endpoint run deep vulnerability assessments. These scanners often utilize XMRIG-based