ThreatFox: Coinminer IOCs

Hunt Hypothesis

This hunt targets the presence of known Coinminer indicators of compromise to identify systems potentially compromised by cryptomining malware that consumes excessive CPU resources. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to detect and isolate infected assets before they significantly impact performance or serve as a foothold for further lateral movement.

IOC Summary

Malware Family: Coinminer Total IOCs: 6 IOC Types: md5_hash, sha256_hash, sha1_hash

Type	Value	Threat Type	First Seen	Confidence
sha1_hash	`834eb7d4d51b265ef55d3df05d5dd111c281b792`	payload	2026-09-06	95%
md5_hash	`283523c3039c3b3d487d67228ff68f4e`	payload	2026-09-06	95%
sha256_hash	`6f214677935f50a69685970fab32c966e16e3b6dffd216fc897534a158b3f561`	payload	2026-09-06	95%
md5_hash	`15b76068e4b451b21d40529d0c99c9ca`	payload	2026-09-06	95%
sha256_hash	`8cd47f460e7662bd783f60167be6eba941e29377abf3d21213ab0b0f19fe1ce4`	payload	2026-09-06	95%
sha1_hash	`a3dfaa61c695d75e1ef22fe108515ff93505945d`	payload	2026-09-06	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Coinminer
let malicious_hashes = dynamic(["834eb7d4d51b265ef55d3df05d5dd111c281b792", "283523c3039c3b3d487d67228ff68f4e", "6f214677935f50a69685970fab32c966e16e3b6dffd216fc897534a158b3f561", "15b76068e4b451b21d40529d0c99c9ca", "8cd47f460e7662bd783f60167be6eba941e29377abf3d21213ab0b0f19fe1ce4", "a3dfaa61c695d75e1ef22fe108515ff93505945d"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Coinminer

False Positive Guidance

Legitimate Cryptocurrency Mining for R&D or Testing
- Scenario: A DevOps or Data Science team runs a local instance of minerd or xmrig on a development VM or container to benchmark GPU/CPU performance or test blockchain integrations. The process name or binary hash matches a known ThreatFox IOC.
- Filter/Exclusion: Exclude processes where the parent process is a development tool (e.g., docker.exe, kubectl, python.exe) or where the process path resides in specific R&D directories (e.g., C:\Projects\crypto-bench\). Additionally, exclude if the process is running under a service account with a “Dev” or “Test” group membership.
Hardware Diagnostics and Stress Testing
- Scenario: IT support or hardware vendors run stress testing utilities like IntelBurnTest, Prime95, or OCCT to validate new server hardware or diagnose thermal issues. These tools often spawn high-CPU processes that may share naming conventions or memory signatures with coinminer IOCs.
- Filter/Exclusion: Exclude if the process name is in a known whitelist of diagnostic tools (prime95.exe, intelburntest.exe, occt.exe). Also, exclude if the process is initiated by a scheduled task named “Hardware_Diagnostic” or if the user context is a dedicated “IT_Support” account.
CI/CD Pipeline Build Agents
- Scenario: In a Kubernetes or Jenkins environment, build agents may spawn short-lived processes for compiling code or running unit tests that involve heavy CPU usage. If the build script downloads a specific compiler or linker binary that matches a ThreatFox hash, or if the agent itself is misconfigured to run a mining script during idle periods, it triggers the rule.
- *Filter/Exclusion