ThreatFox: Coinminer IOCs

Hunt Hypothesis

This detection rule identifies adversary behavior characterized by the execution of known coinminer indicators that often signal a post-compromise resource hijacking or initial persistence strategy. A SOC team should proactively hunt for these IOCs in Azure Sentinel to rapidly isolate compromised assets before attackers can fully establish mining operations and exhaust system resources.

IOC Summary

Malware Family: Coinminer Total IOCs: 3 IOC Types: sha1_hash, md5_hash, sha256_hash

Type	Value	Threat Type	First Seen	Confidence
sha1_hash	`219d35e9f33b48b3fc1ee51cb4fed27616c09d5f`	payload	2026-08-21	95%
md5_hash	`9853d168bdc4e85fb0c9d2446b5d13ff`	payload	2026-08-21	95%
sha256_hash	`02522eaec42abfb57e780e43fda7ef0cc4f0e6d061c2e35aaa3575d5b62f7c13`	payload	2026-08-21	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Coinminer
let malicious_hashes = dynamic(["219d35e9f33b48b3fc1ee51cb4fed27616c09d5f", "9853d168bdc4e85fb0c9d2446b5d13ff", "02522eaec42abfb57e780e43fda7ef0cc4f0e6d061c2e35aaa3575d5b62f7c13"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Coinminer

False Positive Guidance

Here are specific false positive scenarios and corresponding exclusion strategies for the ThreatFox: Coinminer IOCs detection rule in an enterprise environment:

Scenario: Scheduled GPU Stress Testing by DevOps Teams
- Context: DevOps engineers frequently run automated scripts using tools like nload or custom Python wrappers to benchmark new server hardware before deployment. These tests often spawn high-CPU processes that match the hash signatures of known coinminer binaries (e.g., xmrig, cpuminer).
- Filter/Exclusion: Create a rule exception for processes launched by specific service accounts (e.g., svc-devops) or within designated “Staging” subnets. Additionally, exclude alerts where the parent process is a known automation tool like Ansible or Jenkins Agent.
Scenario: Legacy Data Archiving Jobs Utilizing Compression Tools
- Context: Enterprise backup solutions such as Veeam Backup & Replication or Commvault often utilize high-performance compression algorithms that trigger coinminer-like IOCs during nightly window operations. These jobs may spawn temporary worker processes with hashes identical to mining software due to shared cryptographic libraries.
- Filter/Exclusion: Implement a time-based exclusion (e.g., 02:00–06:00 UTC) for hosts tagged as “Backup Servers.” Furthermore, exclude alerts where the process name contains specific keywords like vbrservice or commvault and the parent process is the backup engine executable.
Scenario: Virtualization Host Resource Monitoring
- Context: Hypervisor platforms like VMware vSphere or Microsoft Hyper-V run background monitoring agents that continuously analyze host resource utilization. These agents may generate network traffic patterns and process behaviors (high CPU, specific registry writes) that mimic the initial handshake of a coinminer connecting to a