ThreatFox: Coinminer IOCs

Hunt Hypothesis

This rule detects the presence of known indicators of compromise associated with coinminer malware, which adversaries deploy to hijack compute resources for cryptocurrency mining. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify and isolate compromised assets before they consume excessive resources or serve as a foothold for further lateral movement.

IOC Summary

Malware Family: Coinminer Total IOCs: 6 IOC Types: md5_hash, sha1_hash, sha256_hash

Type	Value	Threat Type	First Seen	Confidence
sha1_hash	`984a0e0826f6a64db6f453643f3f96cbc8f02baa`	payload	2026-09-08	95%
md5_hash	`b8181d43e0231d5a12038e16ece15329`	payload	2026-09-08	95%
sha256_hash	`ad4e1af8ca493cafc4e4d6b764194af49b9fe8d02c233ce529929627bfac1afd`	payload	2026-09-08	95%
md5_hash	`3e49faab0a462731cda05061dffa697e`	payload	2026-09-08	95%
sha1_hash	`cc4520c0149c1487f1fbeb18aecbd46da561ee9e`	payload	2026-09-08	95%
sha256_hash	`c10d0fc195135663bdc10bdf738dfaaa2fc03e56c737dc6806b126ce6639870c`	payload	2026-09-08	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Coinminer
let malicious_hashes = dynamic(["984a0e0826f6a64db6f453643f3f96cbc8f02baa", "b8181d43e0231d5a12038e16ece15329", "ad4e1af8ca493cafc4e4d6b764194af49b9fe8d02c233ce529929627bfac1afd", "3e49faab0a462731cda05061dffa697e", "cc4520c0149c1487f1fbeb18aecbd46da561ee9e", "c10d0fc195135663bdc10bdf738dfaaa2fc03e56c737dc6806b126ce6639870c"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Coinminer

False Positive Guidance

Cryptocurrency Trading Platform Development: Developers working on internal fintech applications or blockchain nodes may legitimately execute mining algorithms (e.g., ethminer, cgminer) or connect to mining pools for testing purposes.
- Filter/Exclusion: Exclude processes running from specific development directories (e.g., C:\Projects\blockchain-test\) or limit detections to non-development user groups (e.g., exclude DevTeam or QA AD groups).
GPU Stress Testing and Benchmarking: IT operations or hardware teams performing GPU stress tests using tools like FurMark, 3DMark, or nvidia-smi might trigger IOCs related to high CPU/GPU utilization or specific mining-related command-line arguments if the tool uses similar syntax.
- Filter/Exclusion: Exclude processes initiated by known benchmarking tools (e.g., furmark.exe, 3dmark.exe) or limit detections to processes that are not child processes of standard administrative utilities.
Scheduled Data Compression or Hashing Jobs: Legitimate scheduled tasks (e.g., PowerShell scripts using Get-FileHash or Compress-Archive) that process large volumes of data in parallel threads can mimic the high-resource-usage patterns or specific command-line structures associated with coinminers.
- Filter/Exclusion: Exclude processes where the parent process is svchost.exe (for Task Scheduler) or powershell.exe and the command line contains standard administrative verbs like Get-FileHash, Compress, or Backup.
Internal CI/CD Pipeline Build Agents: Continuous Integration/Continuous Deployment (CI/CD) agents (e.g., Jenkins, Azure DevOps agents) often run parallel build jobs that consume significant CPU resources and may execute scripts with complex command-line arguments that overlap with coinminer IOCs.
- *