ThreatFox: Coinminer IOCs

Hunt Hypothesis

This hunt targets the presence of known Coinminer IOCs to identify systems compromised by cryptomining malware that consumes excessive compute resources. Proactively hunting for these indicators in Azure Sentinel allows the SOC to detect and isolate infected workloads before they degrade performance or establish persistence mechanisms.

IOC Summary

Malware Family: Coinminer Total IOCs: 6 IOC Types: sha1_hash, md5_hash, sha256_hash

Type	Value	Threat Type	First Seen	Confidence
md5_hash	`1e5dc1aad3f445c5185d73c747ddcaaa`	payload	2026-09-25	95%
sha256_hash	`2113df6dcbc5b7ec63ea4e50609dd5d210ffcaafe7d0f76ae99fe63ea970fbe6`	payload	2026-09-25	95%
sha1_hash	`bbb11c471f7a815c9399feeb4c90adb19dfb0ed1`	payload	2026-09-25	95%
md5_hash	`e11d3d121c7943ab703068153999a69c`	payload	2026-09-25	95%
sha256_hash	`97a76527d77d1d8e1f8a64ebdbccf60abc10220d1a8425ff48fd10a8f658b181`	payload	2026-09-25	95%
sha1_hash	`17f643eb4e381c811ad212f19473e1d358d553d4`	payload	2026-09-25	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Coinminer
let malicious_hashes = dynamic(["1e5dc1aad3f445c5185d73c747ddcaaa", "2113df6dcbc5b7ec63ea4e50609dd5d210ffcaafe7d0f76ae99fe63ea970fbe6", "bbb11c471f7a815c9399feeb4c90adb19dfb0ed1", "e11d3d121c7943ab703068153999a69c", "97a76527d77d1d8e1f8a64ebdbccf60abc10220d1a8425ff48fd10a8f658b181", "17f643eb4e381c811ad212f19473e1d358d553d4"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Coinminer

False Positive Guidance

Scenario: Scheduled CPU Stress Tests for Hardware Validation
- Context: IT operations or DevOps teams run scheduled stress-ng or linpack jobs on new servers or during maintenance windows to validate CPU performance and thermal limits. These processes often exhibit high CPU usage and specific memory access patterns that match Coinminer IOCs.
- Filter/Exclusion: Exclude processes where the parent process is a known scheduler (e.g., cron, systemd, Task Scheduler) AND the executable path resides in standard system or ops directories (e.g., /usr/bin/, /opt/stress-test/, C:\Program Files\OpsTools\).
Scenario: Legitimate Cryptocurrency Wallet or Exchange Daemon
- Context: In fintech or blockchain-focused enterprises, legitimate daemons like bitcoind, geth (Ethereum), or monerod may be installed on specific application servers. These processes inherently perform cryptographic hashing and can trigger Coinminer detections due to their high CPU load and network behavior.
- Filter/Exclusion: Exclude processes with known legitimate cryptocurrency node executable names (e.g., bitcoind, geth, monerod, litecoind) when running on designated blockchain application server groups or under specific service accounts (e.g., svc-blockchain-node).
Scenario: CI/CD Pipeline Build Agents Compiling Heavy Code
- Context: Continuous Integration/Continuous Deployment (CI/CD) agents (e.g., Jenkins, GitLab Runner, Azure DevOps Agents) spawn short-lived compiler processes (gcc, clang, msbuild) that consume significant CPU resources during build steps. If the IOC logic includes high CPU duration or specific syscall patterns, these transient spikes can be misidentified as coinmining activity.
- *Filter/