ThreatFox: Coinminer IOCs

Hunt Hypothesis

This rule detects the presence of known coinminer indicators of compromise, signaling that an adversary has likely deployed cryptocurrency mining malware to exploit compute resources for financial gain. Proactively hunting for these IOCs in Azure Sentinel is critical to identify and isolate compromised assets before they cause significant performance degradation or serve as a foothold for further lateral movement.

IOC Summary

Malware Family: Coinminer Total IOCs: 2 IOC Types: sha256_hash

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Coinminer
let malicious_hashes = dynamic(["ad99c8578cecc2b567ce3a5606ec30ff9b94b4bff3820fda262d5a098108ee2c", "44593e8065a0f6c19d3a8fe2c49f13d1d202c2f78cf8a6157e01ca6d15164298"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Coinminer

False Positive Guidance

• Scenario: A DevOps engineer runs a containerized CI/CD pipeline that includes a build step for a Rust or Go-based cryptocurrency mining library (e.g., stratum client or minerd) to test performance benchmarks or verify dependency integrity. The process name or memory signature matches the IOCs.
  • Filter/Exclusion: Exclude processes running within specific container runtimes (e.g., docker, containerd) or paths under /var/lib/docker/containers/ if the container image is tagged as ci-build or benchmark-test.
• Scenario: An IT administrator executes a scheduled PowerShell script to deploy a lightweight monitoring agent that uses a shared library with a known Coinminer hash (e.g., a mislabeled libcrypto or mining.dll dependency in a third-party backup tool like Veeam or Commvault).
  • Filter/Exclusion: Exclude file paths associated with known enterprise backup or monitoring software directories (e.g., C:\Program Files\Veeam\, C:\Program Files\Commvault\) and processes initiated by service accounts with S-1-5-18 (SYSTEM) or specific admin group SIDs.
• Scenario: A security team performs a red team exercise or vulnerability scan using tools like Nuclei or Metasploit that load a coinminer module to test detection coverage or simulate a cryptomining attack.
  • Filter/Exclusion: Exclude processes where the parent process is a known security tool (e.g., nuclei.exe, msfconsole.exe, metasploit-framework) or where the user context belongs to the RedTeam or SecurityOps AD group.
• Scenario: A developer on a shared build server compiles a C++ application that links against a static library containing a coinminer function