ThreatFox: Coinminer IOCs

Hunt Hypothesis

This rule detects the presence of known Coinminer indicators of compromise, signaling that an adversary has likely deployed cryptocurrency mining malware to exploit available compute resources for financial gain. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify and isolate compromised workloads before they can significantly degrade performance or establish a foothold for further lateral movement.

IOC Summary

Malware Family: Coinminer Total IOCs: 3 IOC Types: sha256_hash, sha1_hash, md5_hash

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Coinminer
let malicious_hashes = dynamic(["fcefcb26f4021203c5898545c4ce043ad9cc83a2", "78ad2cce134fd6e9819489fabdfeffa1", "a3948d4628c764bd1408883bfc2990bb4432ce014455ff31ed5d47eecb8ef57e"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Coinminer

False Positive Guidance

• Legitimate Cryptocurrency Mining for R&D or Testing: Developers or data scientists may run open-source mining software (e.g., xmrig or ethminer) on specific build servers or test clusters to benchmark hardware performance or validate blockchain integrations.

  • Filter/Exclusion: Exclude hosts tagged with Environment: Dev or Role: BuildServer, or restrict the rule to exclude known IP ranges for the R&D network segment.

• Scheduled Backup or Data Archiving Jobs: Some enterprise backup solutions or custom PowerShell scripts that perform heavy disk I/O or CPU-intensive compression tasks (e.g., 7z or gzip with high compression levels) can exhibit resource consumption patterns similar to coinminers, especially if the IOC includes generic high-CPU or specific process names like miner in the path.

  • Filter/Exclusion: Exclude processes originating from known backup service accounts (e.g., svc-backup) or exclude paths containing \Backup\ or \Archive\ in the file path.

• Docker Container Orchestration Overhead: In containerized environments (Kubelet, Docker Daemon), the container runtime itself or sidecar containers performing health checks or log rotation may spawn short-lived processes that match generic coinminer IOCs (e.g., processes named sh, bash, or specific binary names) due to the high frequency of container start/stop cycles.

  • Filter/Exclusion: Exclude events where the parent process is dockerd, containerd, or kubelet, or filter out processes running within namespaces associated with kube-system or docker.

• CI/CD Pipeline Build Agents: Continuous Integration/Continuous Deployment (CI/CD) agents (e.g., Jenkins, GitLab Runner, Azure DevOps) execute build tasks that can be CPU-intensive and may download or execute temporary binaries that