ThreatFox: Coinminer IOCs

Hunt Hypothesis

This detection identifies adversary behavior where malicious actors deploy cryptocurrency mining software to exploit system resources for illicit profit generation. A SOC team should proactively hunt for these indicators in Azure Sentinel because coinminer infections often operate with low visibility and can significantly degrade performance before triggering traditional alert thresholds.

IOC Summary

Malware Family: Coinminer Total IOCs: 3 IOC Types: sha256_hash, md5_hash, sha1_hash

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Coinminer
let malicious_hashes = dynamic(["52f447218c94376f552d1c2b5bfa01c4ef2b5d32ac9ac061236cd286a9efba67", "b1979a03b72b7ced1fffb9e4dd34e0e01adbfc67", "5a59127af8fcd4d20671f83f4ea243a7"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Coinminer

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Coinminer IOCs detection rule, including actionable filters and exclusions tailored for an enterprise environment:

• Scenario: Scheduled GPU Stress Testing by DevOps Team

  • Context: The DevOps team runs nightly automated stress tests on high-performance workstations using tools like nbench or custom Python scripts to validate hardware stability before deployment. These processes often spawn multiple threads that resemble coinminer behavior (high CPU/GPU utilization and specific network connections).
  • Filter/Exclusion: Exclude the service account used by the automation platform (e.g., svc-devops-automation) from the rule logic, or add a filter excluding process names containing “nbench”, “stress-ng”, or “pytest” when executed on hosts tagged as “Dev-Staging”.

• Scenario: Enterprise Virtualization Host Maintenance

  • Context: During off-hours maintenance windows, the IT Operations team utilizes VMware vSphere or Hyper-V management tools to perform live migration and resource balancing. These hypervisor agents often initiate background processes that mimic coinminer network signatures (specifically connecting to known mining pool ports like 3333 or 4415 for telemetry).
  • Filter/Exclusion: Create an exclusion based on the host role tag “Hypervisor-Host” and exclude process paths matching C:\Program Files\VMware\* or C:\Windows\System32\vmms.exe. Additionally, filter out network connections to internal IP ranges used by the vCenter management cluster.

• Scenario: Legacy Data Analytics Batch Jobs

  • Context: The Business Intelligence department runs heavy ETL (Extract, Transform, Load) jobs using Apache Spark or TIBCO Spotfire on dedicated servers. These batch jobs frequently utilize parallel processing clusters that