ThreatFox: Coinminer IOCs

Hunt Hypothesis

This detection rule identifies cryptocurrency mining malware that infiltrates systems through phishing or exploits to hijack resources for digital currency generation, causing significant performance degradation and financial loss. SOC teams should proactively hunt for these indicators in Azure Sentinel to mitigate unauthorized resource consumption and prevent the broader impact of compromised credentials on organizational infrastructure.

IOC Summary

Malware Family: Coinminer Total IOCs: 3 IOC Types: sha1_hash, md5_hash, sha256_hash

Type	Value	Threat Type	First Seen	Confidence
sha256_hash	`264a6ef8a8853d0e7dac18b0d4e043ab7579b4cc885093128012b34339cee194`	payload	2026-08-01	95%
sha1_hash	`86cc0da2edcd30f78bde7aad92c3976715128d35`	payload	2026-08-01	95%
md5_hash	`af1ac5d2435d139a98962876534adfcb`	payload	2026-08-01	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Coinminer
let malicious_hashes = dynamic(["264a6ef8a8853d0e7dac18b0d4e043ab7579b4cc885093128012b34339cee194", "86cc0da2edcd30f78bde7aad92c3976715128d35", "af1ac5d2435d139a98962876534adfcb"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Coinminer

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Coinminer IOCs rule in an enterprise environment, along with targeted filters and exclusions:

Scenario: Legitimate GPU Stress Testing by DevOps Teams
- Context: DevOps engineers running automated load tests on high-performance workstations or servers (e.g., using nload or custom Python scripts) often spike CPU/GPU usage to 90-100% for extended periods, mimicking the resource exhaustion signature of a coinminer.
- Filter/Exclusion: Create an exclusion rule that suppresses alerts for processes running under specific service accounts (e.g., svc-devops, azure-pipelines) or within designated “Test” and “Staging” network subnets during business hours. Additionally, filter out processes with known hashes for testing tools like JMeter, Locust, or Grafana agents.
Scenario: Scheduled Enterprise Backup Jobs (Veeam/Acronis)
- Context: Heavy backup jobs scheduled overnight (e.g., Veeam Backup & Replication or Acronis Cyber Protect) utilize significant CPU and memory resources to compress and encrypt large datasets, which can be misidentified as a mining process consuming system resources.
- Filter/Exclusion: Implement a time-based exclusion window for the rule between 01:00 and 05:00 local time on weekdays. Furthermore, add specific exclusions for known backup executables such as Veeam.Backup.Service.exe, AcronisCyberProtectAgent.exe, or Commvault services (simcman.exe).
Scenario: CI/CD Pipeline Build Agents (Jenkins/GitLab)
- Context: Continuous Integration servers often spin up temporary build agents that compile code, run unit