ThreatFox: Coinminer IOCs

Hunt Hypothesis

This detection rule identifies active cryptocurrency mining processes that match known ThreatFox indicators of compromise, signaling potential adversary resource hijacking or post-compromise lateral movement. A SOC team should proactively hunt for these coinminer signatures in Azure Sentinel to rapidly isolate compromised workloads before they exhaust system resources and obscure other malicious activities through background noise.

IOC Summary

Malware Family: Coinminer Total IOCs: 6 IOC Types: sha256_hash, md5_hash, sha1_hash

Type	Value	Threat Type	First Seen	Confidence
md5_hash	`73c4a1248e4fb6bb8430872a61ea76ea`	payload	2026-07-27	95%
sha256_hash	`9787788d19b47b0b3a18a71ae37b23a372635d652028601c1d2f99f005070da5`	payload	2026-07-27	95%
sha1_hash	`517c8575d14540ecd15df6714cbb226b2f6c0e21`	payload	2026-07-27	95%
sha256_hash	`9cae45ef7526eb2c7db2a7ed5f5b2af93cb55d5cbecf907f9a07afef887b54b0`	payload	2026-07-27	95%
sha1_hash	`ee1972dd5b96bd33dee22c6bee867e95f0e75c5c`	payload	2026-07-27	95%
md5_hash	`6159d556244d9b3bdf4db6c7ea971cd5`	payload	2026-07-27	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Coinminer
let malicious_hashes = dynamic(["73c4a1248e4fb6bb8430872a61ea76ea", "9787788d19b47b0b3a18a71ae37b23a372635d652028601c1d2f99f005070da5", "517c8575d14540ecd15df6714cbb226b2f6c0e21", "9cae45ef7526eb2c7db2a7ed5f5b2af93cb55d5cbecf907f9a07afef887b54b0", "ee1972dd5b96bd33dee22c6bee867e95f0e75c5c", "6159d556244d9b3bdf4db6c7ea971cd5"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Coinminer

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Coinminer IOCs detection rule, along with targeted filters and exclusions suitable for an enterprise environment:

Scenario: Legitimate Hardware Monitoring via GPU Stress Tests
- Context: System administrators or DevOps engineers running scheduled stress tests on new server deployments using tools like nload, stress-ng, or fio to benchmark CPU/GPU performance. These utilities often spawn high-CPU processes that mimic coinminer behavior by utilizing all available cores and establishing network connections for telemetry reporting.
- Filter/Exclusion: Exclude process names matching known monitoring suites (e.g., stress-ng.exe, nload.exe, fio.exe) running under the context of specific service accounts (e.g., DOMAIN\DevOps-Admin or SYSTEM). Additionally, filter out alerts where the parent process is a scheduled task (svchost.exe with Task Scheduler parent) executing during maintenance windows.
Scenario: Scheduled Backup and Anti-Virus Scanning
- Context: Enterprise backup solutions (e.g., Veeam, Commvault) or endpoint protection suites (e.g., CrowdStrike, Microsoft Defender) performing full system scans or data replication jobs. These operations frequently trigger high CPU utilization and network I/O patterns that overlap with coinminer signatures, particularly when the detection logic flags specific hash values associated with these tools’ update modules.
- Filter/Exclusion: Create an exclusion list for known backup and AV process hashes (e.g., VeeamTransportService.exe, ccSvcHst.exe). Implement a time-based filter to suppress alerts originating from these processes during defined maintenance windows (e.g., 02:00–04:00 UTC) when heavy batch jobs are expected.
**Scenario: CI/CD Pipeline Artifact Compilation