ThreatFox: Coinminer IOCs

Hunt Hypothesis

This detection rule identifies adversary behavior characterized by the execution of known coin mining indicators, signaling potential resource hijacking or a precursor to larger ransomware campaigns. A proactive hunt is essential in Azure Sentinel to rapidly isolate compromised workloads before excessive CPU consumption degrades performance and financial costs escalate due to unauthorized cryptocurrency generation.

IOC Summary

Malware Family: Coinminer Total IOCs: 6 IOC Types: md5_hash, sha1_hash, sha256_hash

Type	Value	Threat Type	First Seen	Confidence
sha256_hash	`fecfd59e63c518834a601e32e782390f88c9749dcf1460c94a687d766c757718`	payload	2026-08-22	95%
sha1_hash	`a60a603271f8394c19b1e1c3a8da83e8ec05d0b6`	payload	2026-08-22	95%
md5_hash	`a8eedaa9a5d431baf445c8080ac35fda`	payload	2026-08-22	95%
md5_hash	`90d5a367d6456e854288cc32e33049b0`	payload	2026-08-22	95%
sha256_hash	`febb60b38e035167c3c5260aa038302d538ffd6ce352679f4b66db231bd7ccaa`	payload	2026-08-22	95%
sha1_hash	`90c729146fb83248e71297ace43add52b42d0a09`	payload	2026-08-22	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Coinminer
let malicious_hashes = dynamic(["fecfd59e63c518834a601e32e782390f88c9749dcf1460c94a687d766c757718", "a60a603271f8394c19b1e1c3a8da83e8ec05d0b6", "a8eedaa9a5d431baf445c8080ac35fda", "90d5a367d6456e854288cc32e33049b0", "febb60b38e035167c3c5260aa038302d538ffd6ce352679f4b66db231bd7ccaa", "90c729146fb83248e71297ace43add52b42d0a09"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Coinminer

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Coinminer IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

Legitimate Scheduled GPU Stress Testing
- Scenario: IT operations teams often run automated stress tests on high-performance workstations or rendering nodes using tools like FurMark or custom scripts invoking nvidia-smi. These processes may spawn child processes with hashes matching known coinminer binaries (e.g., xmr-stak, ethash) to validate GPU stability, triggering the rule.
- Filter/Exclusion: Create a whitelist exclusion for specific process names (FurMark.exe, nvidia-smi) running under the context of the “System” or “Local Service” account on designated asset groups (e.g., “Rendering_Fleet”). Additionally, exclude events occurring during maintenance windows (e.g., Sundays 02:00–04:00 UTC).
DevOps CI/CD Pipeline Builds
- Scenario: Continuous Integration servers (such as Jenkins, GitLab Runners, or Azure DevOps Agents) frequently compile large codebases. During the build phase, these agents may download and execute open-source mining tools as part of a dependency check or container image verification step, generating IOCs that match the coinminer signature.
- Filter/Exclusion: Exclude alerts originating from specific hostnames matching the pattern *-ci-runner-* or IP ranges assigned to the DevOps subnet. Implement a filter to ignore detections where the parent process is java.exe, node.exe, or dockerd.exe.
Security Tool Health Checks & Telemetry
- Scenario: Endpoint Detection and Response (EDR) agents like CrowdStrike Falcon, Microsoft Defender for Endpoint, or Carbon Black