URLhaus: CoinMiner Malicious URLs

Hunt Hypothesis

This hypothesis detects adversaries deploying CoinMiner malware via malicious URLs to hijack system resources for unauthorized cryptocurrency mining, which significantly degrades performance and increases operational costs. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify early-stage compromises that may evade traditional signature-based detection while preventing resource exhaustion across the enterprise environment.

IOC Summary

Threat: CoinMiner Total URLs: 3 Active URLs: 2

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: CoinMiner
let malicious_domains = dynamic(["cloud.calltop.com.br", "casasmediterraneas.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["cloud.calltop.com.br", "casasmediterraneas.com"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 5 specific false positive scenarios for the URLhaus: CoinMiner Malicious URLs rule, including targeted filters and exclusions:

• Legitimate Cloud-Based Crypto Analytics Dashboards

  • Scenario: Financial analysts or risk management teams routinely access cloud-based cryptocurrency market analysis platforms (e.g., CoinMarketCap, TradingView, or Bloomberg Terminal) which host legitimate mining data widgets. These sites often load scripts from domains that share URL patterns with known CoinMiner infrastructure, triggering the rule when users browse real-time asset performance charts.
  • Filter/Exclusion: Create an allow-list for specific trusted domains (e.g., *.coinmarketcap.com, *.tradingview.com) and exclude traffic originating from user groups tagged as “Finance” or “Risk Management.”

• Scheduled DevOps Container Health Checks

  • Scenario: Automated CI/CD pipelines using tools like Jenkins, GitLab Runners, or Azure DevOps execute scheduled jobs to pull container images and health-check scripts from public registries. Some of these registries (e.g., Docker Hub, Quay.io) utilize CDN endpoints that CoinMiner signatures may flag as suspicious due to high-volume data transfer patterns resembling mining activity.
  • Filter/Exclusion: Exclude traffic generated by service accounts (e.g., svc-jenkins-build, azure-devops-agent) and filter URLs containing specific path parameters common in container registry APIs (e.g., /v2/_catalog or /api/v1/images).

• Enterprise Endpoint Management & Patching Agents

  • Scenario: System administrators deploy Microsoft Intune, Jamf Pro, or SolarWinds to push updates and inventory scans. These agents frequently download configuration manifests and telemetry data from vendor update servers that CoinMiner heuristics might misidentify as mining