ThreatFox: Coinminer IOCs

Hunt Hypothesis

This detection rule identifies adversary behavior where Coinminer malware infiltrates systems through phishing vectors or exploit kits to hijack resources for cryptocurrency mining, causing significant performance degradation and financial risk. A SOC team should proactively hunt for these indicators in Azure Sentinel to rapidly isolate compromised endpoints before resource exhaustion impacts critical operations and enables potential lateral movement by the attacker.

IOC Summary

Malware Family: Coinminer Total IOCs: 6 IOC Types: sha256_hash, sha1_hash, md5_hash

Type	Value	Threat Type	First Seen	Confidence
md5_hash	`91dddfbe6ec0216a43e4266acd65e7c7`	payload	2026-08-07	95%
sha256_hash	`72b0ee76e31527fa94e063ef15580037a2148bf59d6f981faab92a82f5403d58`	payload	2026-08-07	95%
sha1_hash	`474b10003a3ba9ecca035757c37570df3529bcc5`	payload	2026-08-07	95%
sha1_hash	`8c21a9815d0d6d82a82e00ec8c047606b0022ecc`	payload	2026-08-07	95%
md5_hash	`7d289e6e0baa505ca6a4852958b61139`	payload	2026-08-07	95%
sha256_hash	`51498477da8c0c5abf4cca3de0704a83d513c4005c2f4f3bb09fc8121e1189dc`	payload	2026-08-07	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Coinminer
let malicious_hashes = dynamic(["91dddfbe6ec0216a43e4266acd65e7c7", "72b0ee76e31527fa94e063ef15580037a2148bf59d6f981faab92a82f5403d58", "474b10003a3ba9ecca035757c37570df3529bcc5", "8c21a9815d0d6d82a82e00ec8c047606b0022ecc", "7d289e6e0baa505ca6a4852958b61139", "51498477da8c0c5abf4cca3de0704a83d513c4005c2f4f3bb09fc8121e1189dc"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Coinminer

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Coinminer IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

Legitimate GPU-Intensive Rendering or Data Processing Jobs
- Scenario: Scheduled nightly jobs utilizing high-performance workstations (e.g., AutoCAD, Blender, or MATLAB) trigger the rule due to sustained high CPU/GPU utilization patterns that mimic coinminer behavior. These tasks often involve heavy memory allocation and network I/O for asset fetching.
- Filter/Exclusion: Create an exclusion based on specific process names (blender.exe, matlab.exe, autocad.exe) running under the context of known service accounts (e.g., svc_rendering). Additionally, filter out alerts occurring during defined maintenance windows (e.g., 02:00–06:00 local time) on designated “High-Compute” server groups.
Enterprise Antivirus or EDR Real-Time Scanning
- Scenario: The organization’s endpoint protection suite (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint, or Carbon Black) performs aggressive real-time scanning of large file repositories or database backups. This generates high I/O and CPU spikes that the detection logic interprets as mining activity.
- Filter/Exclusion: Exclude processes belonging to the primary EDR agent (e.g., C-Drive\Program Files\CrowdStrike\Falcon\csfalcon.exe or MsMpEng.exe) from triggering this rule. Implement a filter that suppresses alerts if the parent process is identified as the security agent itself, regardless of resource usage metrics.
Scheduled System Health Monitoring and Diagnostics
- Scenario: Automated diagnostic tools (such as SolarWinds, Datadog agents, or custom PowerShell scripts) execute periodic system health checks