ThreatFox: Coinminer IOCs

Hunt Hypothesis

This detection rule identifies active cryptocurrency mining malware that exploits system resources to generate unauthorized digital currency revenue while degrading host performance. A proactive hunt in Azure Sentinel is essential to rapidly isolate compromised endpoints and prevent financial loss caused by resource exhaustion from phishing or web-based infection vectors.

IOC Summary

Malware Family: Coinminer Total IOCs: 6 IOC Types: sha256_hash, sha1_hash, md5_hash

Type	Value	Threat Type	First Seen	Confidence
sha1_hash	`f4ecc1edd84194b94aceb5c3485b830081507508`	payload	2026-08-28	95%
md5_hash	`18054d12b0ba2dc0c9918f455ec86699`	payload	2026-08-28	95%
sha256_hash	`245f6e3f6750701d58c06bd96f4623c62942305fb32bcdc5a99bf367becaafd0`	payload	2026-08-28	95%
md5_hash	`c7d899d6f7ccecb85c409767d8645906`	payload	2026-08-28	95%
sha256_hash	`656b90c4553ec077f0ff60bf35edee765dffa4d63d4e2148221f9ef1171bb437`	payload	2026-08-28	95%
sha1_hash	`4cecb2462dfdbf0869cab54eef5de1d793c21c80`	payload	2026-08-28	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Coinminer
let malicious_hashes = dynamic(["f4ecc1edd84194b94aceb5c3485b830081507508", "18054d12b0ba2dc0c9918f455ec86699", "245f6e3f6750701d58c06bd96f4623c62942305fb32bcdc5a99bf367becaafd0", "c7d899d6f7ccecb85c409767d8645906", "656b90c4553ec077f0ff60bf35edee765dffa4d63d4e2148221f9ef1171bb437", "4cecb2462dfdbf0869cab54eef5de1d793c21c80"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Coinminer

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Coinminer IOCs detection rule, including tailored filters and exclusions:

Legitimate Scheduled Crypto Asset Audits by Finance Teams
- Scenario: The finance department utilizes a scheduled PowerShell script (Invoke-CryptoAudit.ps1) running via Windows Task Scheduler every Tuesday at 02:00 AM to audit internal blockchain ledger nodes. This process spawns high-CPU threads that mimic coinminer behavior (e.g., node.exe or custom mining binaries) and connects to external validation servers, triggering the rule’s network and resource usage heuristics.
- Filter/Exclusion: Create a whitelist exclusion for the specific hash of the audit script and the associated process path (C:\Finance\Scripts\Invoke-CryptoAudit.ps1). Additionally, exclude the scheduled task name “CryptoLedger_Audit” from the detection logic during its defined execution window (02:00–04:00 UTC).
DevOps Container Orchestration and CI/CD Pipelines
- Scenario: The DevOps team runs nightly Jenkins pipelines that spin up temporary Docker containers to test new microservices. These containers often include lightweight mining daemons for performance benchmarking or utilize tools like golang-metrics which consume significant CPU cycles, resembling the resource footprint of a coinminer infection on the host machine.
- Filter/Exclusion: Exclude processes running within specific Kubernetes namespaces (e.g., dev-staging, ci-pipeline) and filter out any process instances where the parent process is jenkins-agent or dockerd. Implement a rule to ignore high CPU usage if the process duration exceeds 4 hours without network outbound connections to known malicious mining pools.
Enterprise Digital Forensics and EDR Scanning Operations
- Scenario: The