ThreatFox: Coinminer IOCs

Hunt Hypothesis

This detection rule identifies adversary behavior characterized by the execution of known Coinminer indicators of compromise (IOCs) that signal unauthorized cryptocurrency mining activities within the environment. The SOC team should proactively hunt for these specific IOCs in Azure Sentinel to rapidly detect and contain resource-draining cryptojacking attacks before they significantly impact system performance or incur unexpected costs.

IOC Summary

Malware Family: Coinminer Total IOCs: 6 IOC Types: sha1_hash, md5_hash, sha256_hash

Type	Value	Threat Type	First Seen	Confidence
sha1_hash	`342c4be8c2e13195aa0306abbd3f4f95937e8423`	payload	2026-07-02	95%
md5_hash	`7abe81a4699823626728990671b4038f`	payload	2026-07-02	95%
sha256_hash	`51496979cca2c2e036b2993e9fd5b583175b6aeb37df0a635bf4453abd3cc573`	payload	2026-07-02	95%
md5_hash	`9eeb5e790993b3227f7a147a167e30c4`	payload	2026-07-02	95%
sha256_hash	`03a5770f345ad88c9628354cff3ced7cfd2c92ff187182881550ca9a8da3866c`	payload	2026-07-02	95%
sha1_hash	`cdc4a23302b677d374ce2910fa923a04dbec4282`	payload	2026-07-02	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Coinminer
let malicious_hashes = dynamic(["342c4be8c2e13195aa0306abbd3f4f95937e8423", "7abe81a4699823626728990671b4038f", "51496979cca2c2e036b2993e9fd5b583175b6aeb37df0a635bf4453abd3cc573", "9eeb5e790993b3227f7a147a167e30c4", "03a5770f345ad88c9628354cff3ced7cfd2c92ff187182881550ca9a8da3866c", "cdc4a23302b677d374ce2910fa923a04dbec4282"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Coinminer

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Coinminer IOCs detection rule in an enterprise environment, along with suggested filters or exclusions:

Scheduled Software Updates via SCCM/Intune
- Scenario: The endpoint management system (e.g., Microsoft Endpoint Configuration Manager or Intune) pushes a scheduled update for the “AMD Radeon Pro” graphics drivers or “Intel Graphics Command Center.” These legitimate installer packages often contain known Coinminer-related DLLs or executable hashes that match the ThreatFox IOCs, triggering alerts during the nightly maintenance window.
- Filter/Exclusion: Exclude processes initiated by ccmexec.exe (SCCM) or IntuneManagementExtension.exe where the parent process is a trusted system service account (e.g., NT SERVICE\CCM). Additionally, filter out events occurring strictly within the defined maintenance window (e.g., 02:00–05:00 UTC).
IT Asset Inventory Scans
- Scenario: Enterprise asset management tools like SolarWinds RMM, Lansweeper, or PDQ Deploy perform routine hardware and software discovery scans. These agents often download temporary diagnostic scripts or deploy lightweight telemetry modules that utilize cryptographic hashing libraries identical to those flagged in the Coinminer IOC set, causing a match during inventory sweeps.
- Filter/Exclusion: Create an exclusion rule for processes launched by known asset management agents (e.g., SolarWinds.Agent.exe, LansweeperAgent.exe). Ensure the filter checks that the process path resides within the standard installation directory (C:\Program Files\SolarWinds\...) rather than a generic user temp folder.
Virtualization Management and Guest Tools
- Scenario: In virtualized environments (VMware vSphere or Microsoft Hyper-V), the deployment of