ThreatFox: Coinminer IOCs

Hunt Hypothesis

This hypothesis targets the presence of known Coinminer indicators of compromise, which often signal unauthorized cryptocurrency mining operations designed to exploit compute resources for financial gain. Proactively hunting for these IOCs in Azure Sentinel is critical to identify and isolate compromised workloads before they degrade performance, increase cloud costs, or serve as a foothold for further lateral movement.

IOC Summary

Malware Family: Coinminer Total IOCs: 3 IOC Types: sha256_hash, sha1_hash, md5_hash

Type	Value	Threat Type	First Seen	Confidence
sha256_hash	`19bebe9719e4f9c21631f7389c445d6f05550c2867024d54177cb14eea88d89d`	payload	2026-09-12	95%
sha1_hash	`ab225b56f24326c9c79687e8a884648a68ad1647`	payload	2026-09-12	95%
md5_hash	`3c55633d66761f990433756516db965c`	payload	2026-09-12	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Coinminer
let malicious_hashes = dynamic(["19bebe9719e4f9c21631f7389c445d6f05550c2867024d54177cb14eea88d89d", "ab225b56f24326c9c79687e8a884648a68ad1647", "3c55633d66761f990433756516db965c"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Coinminer

False Positive Guidance

Legitimate DevOps CI/CD Pipeline Execution: Developers often run containerized build jobs or local test environments that include open-source mining benchmarks (e.g., ethminer or cgminer) to validate GPU performance or test resource limits.
- Filter/Exclusion: Exclude processes where the parent process is a known CI/CD agent (e.g., jenkins-agent, drone-runner, gitlab-runner) or where the working directory resides under standard build paths like /var/lib/jenkins/workspace/ or C:\Jenkins\workspace\.
Internal Load Testing and Benchmarking: Performance engineers may deploy temporary instances of stress-ng or kbench alongside mining binaries to simulate high CPU/GPU load for capacity planning, often running these from a dedicated “QA-Perf” service account.
- Filter/Exclusion: Exclude events where the user account belongs to a specific group (e.g., Perf-Testing-Team) or where the process is launched from a specific directory (e.g., C:\Tools\Benchmarking\) and the process lifetime is less than 4 hours.
Legacy Application Dependency: Some older, niche financial or scientific software packages bundle a lightweight, obfuscated mining binary (or use a shared library with a similar hash) for parallel processing tasks, which can be misidentified as a standalone coinminer.
- Filter/Exclusion: Correlate the process creation with a known parent application (e.g., matlab.exe, blender.exe, adobe_premiere.exe) and exclude if the coinminer binary is located within the application’s installation directory (e.g., C:\Program Files\LegacyApp\bin\).
Scheduled Maintenance Jobs: IT operations teams may schedule periodic hardware health checks that temporarily spin up a high-load process (sometimes using