ThreatFox: XMRIG IOCs

Hunt Hypothesis

This detection rule identifies adversary behavior involving the deployment of XMRIG cryptocurrency mining tools to establish a persistent presence and consume host resources for potential cryptomining or lateral movement activities. A SOC team should proactively hunt for these indicators in Azure Sentinel because early identification of XMRIOCs allows for rapid containment of unauthorized mining processes before they escalate into significant performance degradation or serve as a foothold for broader network compromise.

IOC Summary

Malware Family: XMRIG Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - XMRIG
let malicious_ips = dynamic(["216.9.226.82", "194.116.236.129"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["216.9.226.82", "194.116.236.129"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — XMRIG

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the ThreatFox: XMRIG IOCs detection rule in an enterprise environment:

• Scenario: DevOps CI/CD Pipeline Execution

  • Context: Automated build agents (e.g., Jenkins, GitLab Runners) or container orchestration controllers (Kubernetes) frequently spin up ephemeral containers to compile code. These environments often utilize xmrig as a lightweight benchmarking tool for CPU stress testing during nightly integration tests or as part of the “crypto-mining” feature set in blockchain development projects.
  • Filter/Exclusion: Exclude processes running within specific container namespaces (e.g., k8s.io/pods) or restrict the detection to exclude known build agent hostnames (e.g., jenkins-agent-*, gitlab-runner-*). Additionally, filter out any XMRIG instances where the command line arguments contain flags like --bench or --test.

• Scenario: Scheduled Hardware Stress Testing by IT Operations

  • Context: The Infrastructure team runs a scheduled nightly job using PowerShell or Ansible to validate new server hardware before deployment. This job launches XMRIG in the background for 15 minutes to verify CPU thermal throttling and memory stability on fresh endpoints, which triggers the IOC match despite being a benign administrative task.
  • Filter/Exclusion: Create an exclusion based on the parent process name (e.g., powershell.exe or ansible-runner) when XMRIG is launched as a child process. Alternatively, implement a time-based filter to suppress alerts for this rule between 02:00 and 04:00 UTC, aligning with the maintenance window.

• Scenario: Internal Blockchain & Ledger Development

  • Context: The enterprise’s internal R&D division maintains a private blockchain network (e.g