ThreatFox: Coinminer IOCs

Hunt Hypothesis

This detection rule identifies active coin mining campaigns by correlating Azure Sentinel logs against nine specific ThreatFox indicators of compromise known to be associated with cryptocurrency miners. Proactively hunting for these behaviors is critical because unauthorized coin mining often signifies a compromised host that could lead to significant performance degradation and potential lateral movement within the cloud environment.

IOC Summary

Malware Family: Coinminer Total IOCs: 9 IOC Types: sha256_hash, sha1_hash, md5_hash

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Coinminer
let malicious_hashes = dynamic(["5d1307ffad96536894481fead93401448cc6adac", "99ad52820bd7ae090c578610e367fcdb", "916cf18c98363cf3419b4d51e9635dd1c610adb3b6d6264aac3f52a02b77541a", "b434022c41d8380221ddd621eaae69b0f0eb2503ac53069ef7f932f45cdf81d7", "8cced0e041a11e7d0d85c3c9b7595e70004b7414", "c3fb146a44516f025122c71348c36b0e", "11ae2d71c9ccae0fa60dc80eedf85ebf784267c28ca42e9c14fffa06515e097a", "0e6e9304c236469d4e8a62ac9bcbfca6ca7a1114", "7d7fd1e5a3ef87809b2e82e000f835c7"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Coinminer

False Positive Guidance

• Scenario: Legitimate deployment of monitoring agents or backup software that utilizes similar cryptographic hashing algorithms or network signatures to the detected coinminer IOCs. For instance, SolarWinds Orion or Veeam Backup & Replication often establish persistent connections and process data in a manner that mimics coinminer behavior during peak load windows.

  • Suggested Filter: Exclude processes originating from specific trusted application paths (e.g., C:\Program Files\Microsoft System Center Configuration Manager\ or C:\Program Files\Veeam\Backup and Replication Enterprise Edition\) and filter out alerts where the process owner is a known service account (e.g., DOMAIN\svc_backup).

• Scenario: Scheduled administrative maintenance jobs running during off-hours that perform intensive data compression, encryption, or log analysis tasks. A common example is Microsoft SQL Server executing nightly index rebuilds or Splunk Universal Forwarder ingesting large volumes of logs, which can trigger the specific IOCs related to high CPU utilization and network beaconing.

  • Suggested Filter: Implement a time-based exclusion for alerts occurring between 02:00 and 05:00 local time on weekdays, or create an allow-list for known scheduled tasks identified by their TaskName (e.g., “SQLServerMaintenance” or “SplunkLogIngestion”).

• Scenario: Development environments where engineers utilize containerized build pipelines that spin up temporary mining-like processes. Tools like Jenkins, GitLab CI, or Azure DevOps Agents often run Docker containers executing compilation scripts that match the coinminer network signatures, particularly when using specific base images known to trigger these IOCs.

  • Suggested Filter: Exclude alerts generated on hosts tagged with a “Dev” or “CI/CD” label in your asset inventory, and filter out processes running within container runtimes (e