ThreatFox: XMRIG IOCs | SOC Hunt Feed

Hunt Hypothesis

This rule detects the presence of known XMRIG indicators, which signals an adversary attempting to deploy a popular open-source cryptocurrency miner to covertly harvest computational resources and generate revenue. Proactively hunting for these IOCs in Azure Sentinel allows the SOC team to identify and isolate compromised assets before the miner can fully establish persistence or consume excessive cloud resources, thereby reducing both financial impact and the risk of further lateral movement.

IOC Summary

Malware Family: XMRIG Total IOCs: 3 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`165[.]154[.]227[.]8:22`	botnet_cc	2026-09-21	85%
ip:port	`165[.]154[.]162[.]74:22`	botnet_cc	2026-09-21	85%
ip:port	`36[.]69[.]157[.]49:22`	botnet_cc	2026-09-21	80%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - XMRIG
let malicious_ips = dynamic(["36.69.157.49", "165.154.162.74", "165.154.227.8"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["36.69.157.49", "165.154.162.74", "165.154.227.8"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — XMRIG

False Positive Guidance

Scenario: A DevOps engineer uses xmr-stak or a compatible XMRIG build for CPU-based stress testing or benchmarking new server hardware before deployment.
- Filter/Exclusion: Exclude processes where the parent process is stress-ng, iperf3, or a specific benchmarking script (e.g., benchmark_cpu.sh), or exclude executions from the /opt/benchmarks/ directory.
Scenario: An IT administrator manually downloads XMRIG to test the effectiveness of endpoint detection and response (EDR) rules or to validate a new threat hunting query in a non-production environment.
- Filter/Exclusion: Exclude events where the user account belongs to the IT-Testers or Security-Validation group, or exclude executions from temporary directories like C:\Users\Public\Downloads\ or /tmp/ if the user is in a test group.
Scenario: A legacy application or custom internal tool bundles a static binary of XMRIG (or a similar miner) for local data processing tasks that require high CPU utilization, such as image compression or video transcoding, and runs it as a scheduled task.
- Filter/Exclusion: Exclude the specific binary path (e.g., C:\Program Files\InternalTools\compressor.exe) if it is known to be a signed internal tool, or exclude scheduled tasks named DailyMediaProcess that execute this specific binary.
Scenario: A developer uses XMRIG as a lightweight CPU load generator during local unit testing of a high-concurrency application, running it from a developer’s local machine or a dev-specific VM that is not part of the production fleet.
- Filter/Exclusion: Exclude hosts tagged with env=dev or env=test in your CMDB or asset management system, or exclude processes