ThreatFox: XMRIG IOCs

Hunt Hypothesis

This hunt detects adversary behavior involving the deployment of XMRIG cryptocurrency mining tools to establish a persistent presence and leverage victim resources for covert crypto-mining operations. A SOC team should proactively hunt for these indicators in Azure Sentinel because early identification of XMRIOCs enables the rapid isolation of compromised assets before significant computational resource exhaustion or potential lateral movement occurs.

IOC Summary

Malware Family: XMRIG Total IOCs: 3 IOC Types: ip:port, domain

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - XMRIG
let malicious_ips = dynamic(["156.229.165.166", "107.175.114.96"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["156.229.165.166", "107.175.114.96"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - XMRIG
let malicious_domains = dynamic(["download.stopbanningmydomains.ru"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — XMRIG

False Positive Guidance

Here are the false positive scenarios and corresponding exclusions for the ThreatFox: XMRIG IOCs detection rule:

• Scenario 1: Legitimate Cryptocurrency Mining on Dedicated Nodes

  • Context: The enterprise operates a cluster of dedicated “Green Compute” nodes (e.g., AWS EC2 or Azure VMs) specifically provisioned to run xmrig for internal cryptocurrency mining initiatives or proof-of-work experiments. These servers consistently generate the XMRIG process and network IOCs during business hours.
  • Filter/Exclusion: Create a host-based exclusion rule that suppresses alerts for all systems within the specific “Mining-Cluster” Active Directory Organizational Unit (OU) or those tagged with Purpose=Compute-Mining. Additionally, exclude the executable path C:\Program Files\XMRig\xmrig.exe if it is signed by the official XMRIG developer certificate.

• Scenario 2: Scheduled Maintenance and Backup Jobs

  • Context: A nightly scheduled task (configured via Windows Task Scheduler) runs a custom PowerShell script that utilizes an embedded XMRIG binary to perform CPU stress testing on backup servers before archiving data. This job triggers the detection logic every night at 02:00 AM, mimicking a potential cryptomining infection.
  • Filter/Exclusion: Implement a time-based exclusion window (e.g., 01:30 to 04:30) for the specific backup server group. Alternatively, filter out alerts where the process parent is identified as Task Scheduler Service (svchost.exe -k netsvcs) and the command line arguments contain the specific script identifier -script "StressTest.ps1".

• Scenario 3: Development Environment Testing

  • Context: The DevOps team frequently deploys containerized development environments (using