ThreatFox: Coinminer IOCs

Hunt Hypothesis

This detection rule identifies adversary behavior where malicious actors deploy coinminer malware to covertly exploit host CPU and memory resources for unauthorized cryptocurrency mining operations. A SOC team should proactively hunt for these indicators in Azure Sentinel to mitigate performance degradation on critical workloads and prevent potential lateral movement or resource exhaustion attacks that could impact business continuity.

IOC Summary

Malware Family: Coinminer Total IOCs: 6 IOC Types: sha1_hash, md5_hash, sha256_hash

Type	Value	Threat Type	First Seen	Confidence
md5_hash	`f4b24101f0917af773057ae219396c0a`	payload	2026-08-08	95%
sha256_hash	`4050513fd2c0e7872d037adc911283a8362a5173ff1910ff5eb8890b980e7994`	payload	2026-08-08	95%
sha1_hash	`cbf24d71c84ee8a087d205c43a089a276c4fc342`	payload	2026-08-08	95%
sha1_hash	`912baf829d387831d0dd450744b5cc0d5496000d`	payload	2026-08-08	95%
md5_hash	`2f89f9431bd97dba2fab3cd2f02d6f10`	payload	2026-08-08	95%
sha256_hash	`467ed1f5cfbbb2bbb6f90f75d1b2bcd99dbeb38a65cc4bcc7bd39767a62d5676`	payload	2026-08-08	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Coinminer
let malicious_hashes = dynamic(["f4b24101f0917af773057ae219396c0a", "4050513fd2c0e7872d037adc911283a8362a5173ff1910ff5eb8890b980e7994", "cbf24d71c84ee8a087d205c43a089a276c4fc342", "912baf829d387831d0dd450744b5cc0d5496000d", "2f89f9431bd97dba2fab3cd2f02d6f10", "467ed1f5cfbbb2bbb6f90f75d1b2bcd99dbeb38a65cc4bcc7bd39767a62d5676"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Coinminer

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Coinminer IOCs detection rule, including targeted filters and exclusions suitable for an enterprise environment:

Scenario: Legitimate GPU Stress Testing by DevOps Teams
- Context: DevOps engineers frequently run high-load stress tests on new server builds or CI/CD pipelines using tools like fio, stress-ng,, or custom Python scripts to validate hardware performance. These processes often spike CPU/GPU utilization and network traffic in patterns mimicking coinminer activity.
- Filter/Exclusion: Exclude processes running under specific service accounts (e.g., svc-devops) or within designated “Staging” and “Dev” OU groups. Additionally, filter out alerts where the process name matches known testing tools (stress-ng.exe, fio.exe, pytest-runner.py).
Scenario: Scheduled System Health Monitoring Jobs
- Context: Enterprise monitoring suites like SolarWinds, Datadog Agent, or PRTG Network Monitor execute scheduled jobs that periodically poll system resources, capture hardware metrics, and upload data to the cloud. These agents often spawn child processes with high resource consumption during peak polling windows.
- Filter/Exclusion: Create a whitelist for known monitoring executables (e.g., SolarWinds.Agent.exe, DatadogAgent.exe) regardless of their hash if they are running on standard management ports. Exclude alerts triggered by these specific binaries when the process start time aligns with the defined maintenance window (e.g., 02:00–04:00 daily).
Scenario: Virtualization Host Resource Balancing
- Context: In virtualized environments using VMware vSphere or Microsoft Hyper-V, the hypervisor host often runs background services to balance resource allocation (vMotion,