ThreatFox: Coinminer IOCs

Hunt Hypothesis

This hypothesis targets the presence of known coinminer indicators of compromise, which signal that an adversary is likely executing cryptocurrency mining scripts to monetize stolen compute resources. Proactively hunting for these IOCs in Azure Sentinel is critical to identify and isolate compromised workloads before they consume excessive resources or serve as a foothold for further lateral movement within the environment.

IOC Summary

Malware Family: Coinminer Total IOCs: 3 IOC Types: sha256_hash, sha1_hash, md5_hash

Type	Value	Threat Type	First Seen	Confidence
sha1_hash	`b2a61fa51e6633e6e8779cfe78b62cb323ea3337`	payload	2026-09-04	95%
md5_hash	`128b69594026f6c198c9483eabc2fbdc`	payload	2026-09-04	95%
sha256_hash	`714b9bf949c12a76d47fadad0f1999bb25535cfd1b8392d7dc971eb9525185a5`	payload	2026-09-04	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Coinminer
let malicious_hashes = dynamic(["b2a61fa51e6633e6e8779cfe78b62cb323ea3337", "128b69594026f6c198c9483eabc2fbdc", "714b9bf949c12a76d47fadad0f1999bb25535cfd1b8392d7dc971eb9525185a5"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Coinminer

False Positive Guidance

Legitimate Cryptocurrency Trading or Wallet Synchronization
- Scenario: Financial teams or developers running local cryptocurrency wallet syncers (e.g., geth, parity, or bitcoin-cli) on workstations or build servers. These tools often maintain persistent network connections to specific exchange nodes or peer-to-peer networks that match known Coinminer C2 IPs or domains.
- Filter/Exclusion: Exclude processes named geth, parity, bitcoin-cli, or monerod when the parent process is a recognized development IDE (e.g., code.exe, idea64.exe) or a service manager, and restrict the exclusion to specific financial or R&D security groups.
CI/CD Pipeline Container Builds
- Scenario: Continuous Integration/Continuous Deployment (CI/CD) systems (e.g., Jenkins, GitLab CI, Azure DevOps) spinning up ephemeral Docker containers for build tasks. Some build images include lightweight crypto-mining benchmarks or stress-test tools (e.g., xmrig used for performance testing) that briefly connect to mining pools or use specific CPU-intensive patterns that trigger heuristic IOCs.
- Filter/Exclusion: Exclude events where the container runtime is docker or containerd and the process path resides under /var/lib/docker/containers/ or /usr/libexec/docker/, specifically for short-lived processes (< 5 minutes) in non-production namespaces.
Legacy Application Compatibility Layers
- Scenario: Running legacy 32-bit applications on 64-bit Windows hosts using compatibility layers like Wine or specific vendor-provided translation services. These layers may spawn helper processes that mimic miner behavior (high CPU usage, specific registry keys) or connect to legacy update servers that have been flagged in threat intelligence feeds as Coinminer IOCs due to shared infrastructure.