URLhaus: CoinMiner Malicious URLs

Hunt Hypothesis

This detection rule identifies adversary behavior where CoinMiner cryptocurrency mining malware infiltrates systems through malicious URLs delivered via phishing campaigns, subsequently hijacking computational resources to generate unauthorized digital currency profits. A SOC team should proactively hunt for this activity in Azure Sentinel to mitigate the risk of severe performance degradation and potential financial loss caused by undetected resource exhaustion across the enterprise environment.

IOC Summary

Threat: CoinMiner Total URLs: 2 Active URLs: 2

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: CoinMiner
let malicious_domains = dynamic(["cta.edu.pe"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["cta.edu.pe"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

False Positive Scenarios: URLhaus CoinMiner Malicious URLs

• Scenario 1: Legitimate Browser-Based Crypto Asset Management

  • Context: Enterprise finance teams or IT administrators using legitimate web-based cryptocurrency wallets (e.g., MetaMask, Coinbase Commerce) or blockchain explorers to manage company assets. These tools often load dynamic scripts that interact with mining nodes, which can be misidentified as the CoinMiner malware signature due to similar resource-heavy JavaScript execution patterns.
  • Suggested Filter: Create an exclusion rule for specific trusted domains (e.g., *.coinbase.com, *.metamask.io) and whitelist URLs containing known wallet authentication tokens or API endpoints used by these financial tools.

• Scenario 2: Scheduled Automated Security Scans

  • Context: Internal security operations rely on automated vulnerability scanners (such as Qualys, Tenable, or Microsoft Defender for Endpoint) that periodically probe external resources to check for known threats. These scanners often simulate user traffic by accessing a broad list of URLs, including those hosted on CoinMiner detection feeds, triggering the rule when the scanner’s signature matches the malware’s URL pattern.
  • Suggested Filter: Implement an exclusion based on the source IP address or hostname of the security scanning appliances (e.g., qualys-scan-01.corp.local) and filter out traffic occurring during defined maintenance windows (e.g., 02:00–04:00 UTC) when these jobs are active.

• Scenario 3: Legitimate Cloud-Based Development Environments

  • Context: DevOps teams utilizing containerized development environments or CI/CD pipelines (such as Jenkins, GitHub Actions, or Azure DevOps) that pull dependencies from public repositories. These pipelines often fetch artifacts from URLs that host open-source mining libraries or blockchain SDKs, which can generate traffic patterns ind