This rule detects the presence of known Coinminer malware indicators, which adversaries deploy to covertly harvest system resources for cryptocurrency mining, often following initial access via phishing. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify compromised endpoints before excessive resource consumption triggers noticeable performance degradation or reveals the intrusion through anomalous network traffic.
Malware Family: Coinminer Total IOCs: 3 IOC Types: md5_hash, sha256_hash, sha1_hash
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| sha256_hash | a83232c48043ec9954ac4349ddb6b89f926335545ba708e5e48095b9fa2af085 | payload | 2026-09-26 | 95% |
| sha1_hash | 84f97b0e946678b77a9b77cbc4ad601ea3828759 | payload | 2026-09-26 | 95% |
| md5_hash | 64b250c5436c5e6792c89e38d5b30192 | payload | 2026-09-26 | 95% |
// Hunt for files matching known malicious hashes
// Source: ThreatFox - Coinminer
let malicious_hashes = dynamic(["a83232c48043ec9954ac4349ddb6b89f926335545ba708e5e48095b9fa2af085", "84f97b0e946678b77a9b77cbc4ad601ea3828759", "64b250c5436c5e6792c89e38d5b30192"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
DeviceFileEvents | Ensure this data connector is enabled |
Legitimate High-Performance Compute Tasks: Engineers or data scientists running intensive local simulations, machine learning model training, or video rendering using tools like NVIDIA Nsight, Blender, or PyTorch may cause sustained high CPU/GPU utilization that mimics mining behavior.
C:\Program Files\Blender\, C:\Users\<User>\.conda\envs\ml_env\) or whitelist specific executable names (blender.exe, python.exe when parented by an IDE like code.exe or idea64.exe).Scheduled Backup or Archiving Jobs: Enterprise backup solutions like Veeam Backup & Replication, Acronis Cyber Protect, or Windows Server Backup often perform high-I/O and CPU-intensive operations during scheduled maintenance windows, which can be misidentified as resource-hungry malware.
VeeamBackupSvc.exe, acronis_service.exe) or filter events where the process path contains \Backup\ or \Veeam\ and the parent process is a known service controller.Antivirus/EDR Full System Scans: Security tools such as CrowdStrike Falcon, Microsoft Defender for Endpoint, or Trend Micro perform full disk scans or deep memory inspections that temporarily spike CPU usage to 80-100% for extended periods.
FalconSensor.exe, MsMpEng.exe, Tmcc.exe) or exclude alerts where the process name matches known security agent binaries and the start time aligns with the scheduled scan window.