ThreatFox: Coinminer IOCs

Hunt Hypothesis

This detection rule identifies adversary behavior characterized by the execution of known coinminer indicators that signal potential resource hijacking and unauthorized cryptocurrency mining activities within the environment. The SOC team should proactively hunt for these IOCs in Azure Sentinel to rapidly isolate compromised assets before they incur significant performance degradation or unexpected cloud costs due to sustained high CPU utilization.

IOC Summary

Malware Family: Coinminer Total IOCs: 6 IOC Types: sha256_hash, md5_hash, sha1_hash

Type	Value	Threat Type	First Seen	Confidence
sha1_hash	`7900cfedd44cd639839f0c4f6d382e62fd541046`	payload	2026-08-04	95%
md5_hash	`ba1a663e230ce317ae337b5d83046ee7`	payload	2026-08-04	95%
sha256_hash	`b7b1cf77eccf7fab42d83f57facdb1105d51050295a044ecdf75cc8280679788`	payload	2026-08-04	95%
sha1_hash	`9f28937b9f7e0ea73557bb2354702862b03308ac`	payload	2026-08-04	95%
md5_hash	`94498bcc84599ebe710f3efd951845da`	payload	2026-08-04	95%
sha256_hash	`4b3d9ff0f3eef2684879bea47fb066a259bb2cc18bb0ab0c2f0c069e732dd5e1`	payload	2026-08-04	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Coinminer
let malicious_hashes = dynamic(["7900cfedd44cd639839f0c4f6d382e62fd541046", "ba1a663e230ce317ae337b5d83046ee7", "b7b1cf77eccf7fab42d83f57facdb1105d51050295a044ecdf75cc8280679788", "9f28937b9f7e0ea73557bb2354702862b03308ac", "94498bcc84599ebe710f3efd951845da", "4b3d9ff0f3eef2684879bea47fb066a259bb2cc18bb0ab0c2f0c069e732dd5e1"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Coinminer

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Coinminer IOCs detection rule, along with suggested filters or exclusions tailored for an enterprise environment:

Legitimate GPU Stress Testing by DevOps Teams
- Scenario: The DevOps team utilizes tools like nmon (Linux) or GPU-Z to run periodic stress tests on new server hardware. These utilities often spawn processes with high CPU/GPU utilization that match Coinminer IOCs, particularly when the test scripts invoke specific hashing algorithms similar to mining software.
- Filter/Exclusion: Exclude process names matching nmon, gpu-z.exe, or custom test scripts located in a dedicated C:\DevOps\StressTests directory from the detection logic if they are initiated by the DEVOPS-SVC service account.
Scheduled Antivirus Deep Scan Jobs
- Scenario: Enterprise Endpoint Detection and Response (EDR) solutions like CrowdStrike Falcon or Microsoft Defender for Endpoint often run deep heuristic scans during off-hours. These scans can trigger high CPU usage and network traffic patterns that mimic the behavior of active coin mining, especially when scanning large database files.
- Filter/Exclusion: Create a filter to suppress alerts where the parent process is MsMpEng.exe (Microsoft Defender) or FalconSensor.exe (CrowdStrike), provided the event timestamp falls within the defined maintenance window (e.g., 02:00–04:00 UTC).
Data Center Virtualization Backup Operations
- Scenario: Automated backup jobs using Veeam Backup & Replication or Commvault often involve heavy data compression and encryption tasks. These operations can generate network traffic signatures and process behaviors that overlap with the IOCs used to detect coin mining exfiltration, particularly when backing up virtual machines with high I/O throughput