This hunt targets the presence of known Coinminer indicators of compromise, which adversaries deploy to hijack system resources for cryptocurrency mining without immediate alerting. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify and isolate compromised hosts before they consume excessive CPU cycles or establish persistence, thereby reducing the operational impact of high-severity cryptomining threats.
Malware Family: Coinminer Total IOCs: 6 IOC Types: sha1_hash, md5_hash, sha256_hash
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| md5_hash | 99f5be9f0047403db9afcda21b33ad3e | payload | 2026-09-21 | 95% |
| md5_hash | 3bac388c6f1d1e79944780454f5482f4 | payload | 2026-09-21 | 95% |
| sha256_hash | 7618324f0ee19ea02ac6dd84246501c3de6a4e10d529c63a3a2ce224efd11f24 | payload | 2026-09-21 | 95% |
| sha1_hash | 31bc159b00d2b1ea7fa5acc303fff363854bedb2 | payload | 2026-09-21 | 95% |
| sha256_hash | 7cf2024df87ba1cb23e2db17b154ecd693318dd167a935467c86f57e57c88897 | payload | 2026-09-21 | 95% |
| sha1_hash | a4266f05e5f3d4303c8d0c832577f9c597ea1f1d | payload | 2026-09-21 | 95% |
// Hunt for files matching known malicious hashes
// Source: ThreatFox - Coinminer
let malicious_hashes = dynamic(["99f5be9f0047403db9afcda21b33ad3e", "3bac388c6f1d1e79944780454f5482f4", "7618324f0ee19ea02ac6dd84246501c3de6a4e10d529c63a3a2ce224efd11f24", "31bc159b00d2b1ea7fa5acc303fff363854bedb2", "7cf2024df87ba1cb23e2db17b154ecd693318dd167a935467c86f57e57c88897", "a4266f05e5f3d4303c8d0c832577f9c597ea1f1d"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
DeviceFileEvents | Ensure this data connector is enabled |
Legitimate Crypto Asset Management or Exchange Operations
ethminer, lolMiner, or cgminer) for internal testing, staking, or exchange backend processing. These processes often match the specific binary names, hashes, or command-line arguments associated with known coinminer IOCs.dockerd, containerd) or where the user account belongs to a specific service account group (e.g., svc-crypto-ops). Additionally, filter by process path if the executable resides in a designated application directory (e.g., C:\Apps\CryptoEngine\) rather than temporary or user profile directories.Performance Benchmarking and Stress Testing
stress-ng, sysbench, or nbench) to validate new hardware, test virtual machine resource allocation, or simulate high-load scenarios for capacity planning. These tools can consume 100% CPU and match behavioral IOCs for coinminers, especially if they are downloaded to temporary directories or run by non-standard service accounts.stress, sysbench, nbench, fio). Alternatively, filter based on the user context: exclude if the executing user is part of the IT-Benchmarking or QA-Performance security group, or if the process is initiated by a scheduled task named Weekly-HW-Benchmark.Legacy Application Maintenance or Data Compression