ThreatFox: Coinminer IOCs

Hunt Hypothesis

This hunt detects adversaries deploying Coinminer malware that infiltrates systems through phishing or compromised web resources to covertly consume CPU and memory for cryptocurrency mining. A proactive search in Azure Sentinel is essential to identify early-stage infections before they cause significant performance degradation or permanent hardware damage, allowing the SOC team to isolate affected assets and mitigate resource exhaustion.

IOC Summary

Malware Family: Coinminer Total IOCs: 6 IOC Types: sha1_hash, sha256_hash, md5_hash

Type	Value	Threat Type	First Seen	Confidence
sha1_hash	`f3d99d574240983bcf016ef1c477d2d3c764966a`	payload	2026-08-15	95%
md5_hash	`57dacba3658cf6df28ae9d54c10c98c9`	payload	2026-08-15	95%
sha256_hash	`958f41d1487994caa3cacb8e52176712efa9d13115ea95587c6dec3658bbcee3`	payload	2026-08-15	95%
sha1_hash	`c714a73211957aa0c71defa91d4d6beca8e4abb8`	payload	2026-08-15	95%
md5_hash	`45899f8f753e57ded07eb20ca57be0f1`	payload	2026-08-15	95%
sha256_hash	`d44ff00fe9552510aefbf13c4b986dc094b5aefcd099fd3d7ad6dc816968a50b`	payload	2026-08-15	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Coinminer
let malicious_hashes = dynamic(["f3d99d574240983bcf016ef1c477d2d3c764966a", "57dacba3658cf6df28ae9d54c10c98c9", "958f41d1487994caa3cacb8e52176712efa9d13115ea95587c6dec3658bbcee3", "c714a73211957aa0c71defa91d4d6beca8e4abb8", "45899f8f753e57ded07eb20ca57be0f1", "d44ff00fe9552510aefbf13c4b986dc094b5aefcd099fd3d7ad6dc816968a50b"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Coinminer

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Coinminer IOCs detection rule, along with suggested filters and exclusions tailored for an enterprise environment:

Scenario: Legitimate Enterprise Backup Operations
- Context: Scheduled backup jobs (e.g., using Veeam, Commvault, or Microsoft System Center DPM) often spawn high-CPU processes that match the hash signatures of known coinminer binaries. These tasks run nightly to archive data, causing temporary resource spikes that mimic mining behavior.
- Filter/Exclusion: Create an exclusion rule based on the specific process path and parent process name.
  - Logic: Exclude if Process.Path contains "\Program Files\Veeam\Backup & Replication\" OR Parent.Process.Name == "vss.exe"
  - Action: Whitelist the known hash of the backup executable in the ThreatFox IOC list.
Scenario: Automated Software Deployment via Configuration Management
- Context: Tools like Microsoft SCCM (Endpoint Configuration Manager), Ansible, or Puppet frequently download and execute installation packages during maintenance windows. The extraction and execution of these installers can trigger high CPU usage and network activity that aligns with coinminer IOCs, particularly if the installer uses a generic hashing algorithm similar to mining software.
- Filter/Exclusion: Filter alerts where the parent process is a known deployment agent running during defined maintenance windows (e.g., 02:00–04:00 UTC).
  - Logic: Exclude if Parent.Process.Name == "ccmexec.exe" AND TimeOfDay BETWEEN 02:00 AND 04:00
  - Action: Add the specific SCCM deployment agent hash to the whitelist.
Scenario: Virtualization Host Resource Monitoring