ThreatFox: XMRIG IOCs

Hunt Hypothesis

This hunt detects adversary behavior involving the deployment of XMRIG cryptocurrency mining software to establish a persistent foothold and consume system resources for profit generation or as a precursor to lateral movement. A SOC team should proactively hunt for these indicators in Azure Sentinel because XMRIG is frequently leveraged by threat actors to mask malicious activity through legitimate resource usage, making early identification critical for preventing prolonged undetected presence.

IOC Summary

Malware Family: XMRIG Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - XMRIG
let malicious_ips = dynamic(["119.194.153.12", "31.56.53.172"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["119.194.153.12", "31.56.53.172"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — XMRIG

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the ThreatFox: XMRIG IOCs detection rule in an enterprise environment:

• DevOps CI/CD Pipeline Cryptocurrency Mining Jobs

  • Scenario: DevOps teams often utilize xmrig within Docker containers or Kubernetes pods during build phases to benchmark hardware performance or run specific financial data simulations. These jobs may trigger the IOC when the container pulls the XMRIG binary from a public registry (e.g., docker.io/xmrig/xmrig) and executes it against a test pool, mimicking an active miner infection.
  • Filter/Exclusion: Exclude processes running within known CI/CD namespaces or specific container IDs. Create a filter to allow xmrig execution if the parent process is dockerd, kubeadm, or jenkins-agent and the command line arguments contain flags like --bench or --cpu-only.

• Legacy Financial Data Validation Scripts

  • Scenario: The Finance department utilizes a custom Python script named crypto_audit_validator.exe which embeds a lightweight XMRIG library to validate transaction hashes against blockchain testnets. This script runs nightly via Windows Task Scheduler, generating network traffic and process signatures that match the XMRIG IOC profile exactly.
  • Filter/Exclusion: Add an exclusion for the specific executable hash of crypto_audit_validator.exe located in C:\Program Files\FinanceTools\. Additionally, filter out alerts where the parent process is Task Scheduler (svchost.exe) and the scheduled task name contains “CryptoValidation”.

• IT Asset Management & Hardware Benchmarking

  • Scenario: During quarterly hardware refreshes or new workstation onboarding, IT administrators run a standardized benchmarking suite (e.g., Sysbench or custom PowerShell scripts) that invokes XMRIG