ThreatFox: Coinminer IOCs

Hunt Hypothesis

This detection rule identifies adversary behavior characterized by the execution of known coin mining indicators, which often signal a post-compromise resource hijacking or an initial foothold established through malicious downloads. A SOC team should proactively hunt for these IOCs in Azure Sentinel to rapidly isolate infected assets and prevent performance degradation caused by unauthorized cryptocurrency mining operations before they escalate into broader infrastructure strain.

IOC Summary

Malware Family: Coinminer Total IOCs: 9 IOC Types: sha1_hash, sha256_hash, md5_hash

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Coinminer
let malicious_hashes = dynamic(["6ed072ae91ff6f7f0de6d9b1a382647968e76b34", "5e7f62683bb66cd08d61ea820bea6fe7", "f0b45ac6bb1d96981900bb46d9129c6c3facf2575529cac1ff0145079ef96cbd", "3727f5bde57b562a6c66c1ffdedf2fc52daa47fe", "c6dc1c09565cf12e833d1e5b35688e4e", "4037fc3edbee83ac3544c8bb948b2d237c4bc7ca7f5fc23147d8350fa248e081", "2b93212ee63dbb290d88bc845aafae192552b6de80d93a2f4a6453afb3738676", "77613a3182bd1f5034776bd971707a44bce37f78", "ab06fb2409787be402ccf1b4288b87b3"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Coinminer

False Positive Guidance

Here are specific false positive scenarios and corresponding exclusion strategies for the ThreatFox: Coinminer IOCs detection rule in an enterprise environment:

• Legitimate Scheduled Crypto-Asset Auditing Job

  • Scenario: The Finance or IT Asset team runs a nightly scheduled task using PowerShell or Ansible to query public blockchain APIs (e.g., via curl or wget) for asset valuation reports. This activity generates network connections and process execution patterns that match the Coinminer IOCs, particularly if the script utilizes specific ports or hash signatures common in mining software.
  • Filter/Exclusion: Create a filter to exclude alerts where the parent process is the scheduled task runner (svchost.exe with SchedLgU service) or the PowerShell host (powershell.exe) executing scripts located within the trusted directory C:\ProgramData\Finance\Scripts.

• DevOps CI/CD Pipeline Artifact Scanning

  • Scenario: The DevOps team utilizes Jenkins or GitLab Runner agents to pull container images and scan dependencies. During the build phase, these agents often spawn temporary worker processes that download large artifacts from cloud storage providers (e.g., AWS S3, Azure Blob) which may share network signatures with active mining nodes.
  • Filter/Exclusion: Exclude alerts where the hostname matches the pattern *-ci-runner-* or *-jenkins-agent-*, and the process path is contained within the container orchestration directory (e.g., /var/lib/jenkins/workspace on Linux or D:\Jenkins\workspace on Windows).

• Endpoint Security Agent Performance Monitoring

  • Scenario: Enterprise Endpoint Detection and Response (EDR) solutions like CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne perform periodic high-intensity scans that