URLhaus: CoinMiner Malicious URLs

Hunt Hypothesis

This hunt targets adversaries deploying CoinMiner malware via malicious URLs in phishing campaigns or exploit kits to covertly hijack system resources for cryptocurrency mining. Proactively hunting for this behavior in Azure Sentinel is critical to identify early-stage infections before they cause widespread performance degradation and significant resource exhaustion across the organization’s infrastructure.

IOC Summary

Threat: CoinMiner Total URLs: 6 Active URLs: 6

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: CoinMiner
let malicious_domains = dynamic(["217.60.195.113"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["217.60.195.113"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: CoinMiner Malicious URLs rule in an enterprise environment, along with targeted filtering strategies:

• Scheduled Software Updates via Package Managers

  • Scenario: Automated patch management tools (e.g., Microsoft Endpoint Configuration Manager, WSUS, or Ansible) frequently connect to vendor repositories that host cryptocurrency-related software updates or SDKs. For instance, a scheduled nightly job updating the Visual C++ Redistributable or Java Runtime Environment may trigger connections to URLs hosted on domains recently flagged by URLhaus as CoinMiner due to shared infrastructure with mining pools.
  • Filter/Exclusion: Create an exclusion rule for traffic originating from specific Service Accounts (e.g., svc-patch-mgmt) or restrict the alert to only flag traffic where the User-Agent string does not match known enterprise update agents (e.g., exclude Microsoft-SoftwareUpdate, Ansible-Python).

• Third-Party Cloud Storage and Collaboration Sync

  • Scenario: Enterprise users utilizing cloud storage solutions like OneDrive for Business, SharePoint Online, or Box often encounter URLs containing query parameters that resemble mining pool endpoints. A legitimate user syncing a large dataset involving financial modeling tools (which may include crypto data feeds) might generate HTTPS requests to CDN subdomains (e.g., cdn-*.sharepoint.com) that URLhaus has temporarily flagged due to a shared IP reputation with active CoinMiner campaigns.
  • Filter/Exclusion: Implement a whitelist for known enterprise SaaS domains and their associated CDNs. Additionally, filter out alerts where the destination port is standard (443) and the TLS certificate issuer matches trusted enterprise partners (e.g., DigiCert, GlobalSign) rather than self-signed or generic Let’s Encrypt certs often used by mining farms.