ThreatFox: Coinminer IOCs

Hunt Hypothesis

This detection rule identifies adversary behavior indicative of active coin mining operations by matching network and host telemetry against six specific ThreatFox indicators of compromise. A SOC team should proactively hunt for these signals in Azure Sentinel to rapidly isolate compromised assets before they exhaust system resources or serve as a foothold for broader lateral movement attacks.

IOC Summary

Malware Family: Coinminer Total IOCs: 6 IOC Types: md5_hash, sha256_hash, sha1_hash

Type	Value	Threat Type	First Seen	Confidence
md5_hash	`be2f08950440b3bb987fc5d0999b3f1f`	payload	2026-08-02	95%
sha1_hash	`689a96b72e20cc501fa145637d1cdc3f76d68a3c`	payload	2026-08-02	95%
sha256_hash	`a94e9aca1aca0c7e006a0d8684c5423b1a3bd7e48734eee4f12f0caa3b5d901a`	payload	2026-08-02	95%
sha1_hash	`d5153d09a297bbacb98b50368b353f012adcbb7d`	payload	2026-08-02	95%
md5_hash	`a1af1a6133606bf3f13177df0680ba46`	payload	2026-08-02	95%
sha256_hash	`aef01ab9e284b663cdd5caf288eff4120406ae452f5fb73e4b135c542aa59919`	payload	2026-08-02	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Coinminer
let malicious_hashes = dynamic(["be2f08950440b3bb987fc5d0999b3f1f", "689a96b72e20cc501fa145637d1cdc3f76d68a3c", "a94e9aca1aca0c7e006a0d8684c5423b1a3bd7e48734eee4f12f0caa3b5d901a", "d5153d09a297bbacb98b50368b353f012adcbb7d", "a1af1a6133606bf3f13177df0680ba46", "aef01ab9e284b663cdd5caf288eff4120406ae452f5fb73e4b135c542aa59919"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Coinminer

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: Coinminer IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

Scenario 1: Legitimate GPU Stress Testing by DevOps Teams
- Context: DevOps engineers frequently run performance benchmarks on high-end workstations or servers using tools like NVIDIA Nsight Systems or custom Python scripts utilizing the pandas and numpy libraries to stress-test new hardware before deployment. These processes often exhibit high CPU/GPU utilization patterns similar to coinminers (e.g., xmrig, cudo-miner).
- Filter/Exclusion: Exclude alerts where the parent process is a known development tool or script runner.
  - Logic: ProcessName IN ('nsight', 'python.exe', 'node.exe') AND CommandLine CONTAINS '--benchmark' OR '--stress-test'.
Scenario 2: Scheduled Maintenance Jobs for Virtualization Clusters
- Context: In environments running VMware vCenter or Microsoft Hyper-V, scheduled maintenance jobs (e.g., nightly backups via Veeam Backup & Replication or database index rebuilds) often spawn temporary worker processes that consume significant compute resources. These workers may match IOCs related to mining software due to similar executable names or network signatures during peak load times.
- Filter/Exclusion: Create an exclusion based on the specific scheduled task name and execution window.
  - Logic: ScheduledTaskName IN ('VeeamBackupJob', 'SQLIndexRebuild', 'vCenterHealthCheck') AND ExecutionTime BETWEEN 01:00 AND 05:00.
Scenario 3: IT Asset Inventory and Hardware Scanning
- Context: Enterprise asset management tools