ThreatFox: Coinminer IOCs

Hunt Hypothesis

This detection identifies adversaries deploying Coinminer malware that infiltrates systems through phishing or exploits to hijack resources for cryptocurrency mining and potential lateral movement. Proactive hunting in Azure Sentinel is critical because these stealthy infections often evade standard alerts while causing significant performance degradation and creating a foothold for further network compromise.

IOC Summary

Malware Family: Coinminer Total IOCs: 4 IOC Types: sha1_hash, md5_hash, sha256_hash

Type	Value	Threat Type	First Seen	Confidence
sha256_hash	`9885939da17f13c0dbb0973bb0f8393f6170a8273da18bc7c31d9f88645985ce`	payload	2026-07-31	95%
sha1_hash	`78106530eef55bc0ac87e52d3a151c337663ca7a`	payload	2026-07-31	95%
md5_hash	`77eb919ac3707bc58f178057a2c27a05`	payload	2026-07-31	95%
md5_hash	`d19f7abd0cc5a63ac3683b495413d03b`	payload	2026-07-31	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Coinminer
let malicious_hashes = dynamic(["9885939da17f13c0dbb0973bb0f8393f6170a8273da18bc7c31d9f88645985ce", "78106530eef55bc0ac87e52d3a151c337663ca7a", "77eb919ac3707bc58f178057a2c27a05", "d19f7abd0cc5a63ac3683b495413d03b"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Coinminer

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Coinminer IOCs detection rule, including targeted filters and exclusions tailored for an enterprise environment:

Scenario: Legitimate GPU Stress Testing by DevOps Teams
- Context: DevOps engineers frequently run high-intensity stress tests on new virtual machines or bare-metal servers using tools like nbench, Prime95, or custom Python scripts to validate hardware stability before deployment. These processes often spike CPU and GPU utilization, mimicking the resource exhaustion signature of a coinminer.
- Filter/Exclusion: Create an exclusion rule for processes running under specific service accounts (e.g., svc-devops or admin-build) located within the C:\DevOps\StressTests\ directory. Additionally, filter out alerts where the process command line contains keywords like “stress”, “benchmark”, or “nbench”.
Scenario: Scheduled Data Center Backup and Indexing Jobs
- Context: Enterprise backup solutions (such as Veeam, Commvault, or Microsoft System Center) often utilize high CPU cycles during scheduled windows to compress data and update indexes. Similarly, search indexing services like Elasticsearch or Solr can trigger sustained resource usage that resembles mining activity.
- Filter/Exclusion: Exclude alerts generated by known backup service executables (e.g., VeeamAgent.exe, CommServe.exe) running during defined maintenance windows (e.g., 02:00–06:00 local time). Implement a logic check to suppress the rule if the process parent is a scheduled task (SchTasks.exe or TaskScheduler) with a known job name containing “Backup” or “Index”.
Scenario: Corporate Video Conferencing and Streaming Sessions
- Context: In hybrid work environments, employees running high-definition video conferences via