URLhaus: CoinMiner Malicious URLs

Hunt Hypothesis

This hunt targets the execution of known CoinMiner payloads delivered via malicious URLs, indicating an adversary is actively attempting to leverage organizational compute resources for cryptocurrency mining. Proactively hunting for these specific indicators in Azure Sentinel allows the SOC to identify compromised endpoints before resource-intensive mining operations degrade performance or establish persistence through additional malicious downloads.

IOC Summary

Threat: CoinMiner Total URLs: 2 Active URLs: 2

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: CoinMiner
let malicious_domains = dynamic(["192.162.199.246"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["192.162.199.246"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Legacy Application Health Checks: A legacy internal web application (e.g., a Java-based inventory system) performs automated HTTP GET requests to known CoinMiner URLs as part of a “canary” or connectivity check mechanism to verify outbound internet access is functioning before processing transactions.
  • Filter/Exclusion: Exclude source IPs belonging to the specific application server subnet (e.g., 10.20.5.0/24) when the User-Agent string contains “HealthCheck” or “CanaryProbe”, or exclude the specific process name (e.g., java.exe or tomcat.exe) if the destination port is 80/443 and the request method is GET.
• DevOps Pipeline Dependency Scans: A CI/CD pipeline (e.g., Jenkins or GitLab CI) runs a scheduled job that uses curl or wget to fetch metadata from a public registry or CDN that has been temporarily compromised or misconfigured to serve CoinMiner payloads, or the pipeline explicitly tests outbound connectivity to a list of “known good” URLs that includes one of the CoinMiner domains for latency benchmarking.
  • Filter/Exclusion: Exclude events where the source process is curl.exe, wget.exe, or python.exe (running a script) and the source host is tagged with the environment label ci-cd or build-server, provided the destination URL is in the allowlist of benchmarking endpoints.
• Browser Extension Auto-Update: A corporate-approved browser extension (e.g., a password manager or ad-blocker) attempts to auto-update by contacting its update server, which has been hijacked or is sharing infrastructure with a CoinMiner domain due to a CDN misconfiguration or domain squatting.
  • Filter/Exclusion: Exclude network connections initiated by browser processes (chrome.exe, firefox.exe,