This detection rule identifies active cryptocurrency mining processes by correlating specific threat intelligence indicators from ThreatFox to uncover unauthorized coinminer execution within the environment. Proactive hunting is essential because cryptominers often operate silently in the background, consuming significant computational resources and serving as a potential indicator of lateral movement or post-compromise activity that may not trigger standard alerting thresholds.
Malware Family: Coinminer Total IOCs: 3 IOC Types: md5_hash, sha256_hash, sha1_hash
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| sha1_hash | ce629f8ad9428474bab4b95774102a13b096f516 | payload | 2026-07-24 | 95% |
| md5_hash | 9f95d8290bd17c8319a2f3b47db6bd75 | payload | 2026-07-24 | 95% |
| sha256_hash | 694a3bab92e60e6760649fd40e97c04ff03faded2073e7a0c2e061229bf7820a | payload | 2026-07-24 | 95% |
// Hunt for files matching known malicious hashes
// Source: ThreatFox - Coinminer
let malicious_hashes = dynamic(["ce629f8ad9428474bab4b95774102a13b096f516", "9f95d8290bd17c8319a2f3b47db6bd75", "694a3bab92e60e6760649fd40e97c04ff03faded2073e7a0c2e061229bf7820a"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
DeviceFileEvents | Ensure this data connector is enabled |
Here are specific false positive scenarios and corresponding filters for the ThreatFox: Coinminer IOCs detection rule in an enterprise environment:
Scheduled DevOps Build Agents: CI/CD pipelines often utilize build agents (e.g., Jenkins, GitLab Runner) that spin up temporary containers or VMs to compile code. These agents frequently download large dependencies and execute high-CPU compilation tasks using tools like docker, maven, or npm, which can mimic the network traffic patterns of a coinminer connecting to upstream nodes.
*-build-agent-* or specific IP ranges dedicated to the DevOps cluster, and filter out processes where the executable path contains /var/lib/jenkins or C:\Program Files\GitLab Runner.Enterprise Virtualization Hosts (Hypervisors): In environments running VMware vSphere or Microsoft Hyper-V, the hypervisor host itself often runs background services for resource balancing and live migration. These processes can initiate high-throughput network connections to management servers or storage arrays that resemble coinminer peer-to-peer traffic signatures.
vmware-statsd.exe, vpxd.exe (VMware), or vmmsvc.exe / hvhost.exe (Hyper-V) running on hosts identified by the OS tag “Server” and domain membership in the infrastructure OU.Data Science & AI Workstations: High-performance workstations used by data scientists often run long-duration training jobs using frameworks like TensorFlow or PyTorch. These applications utilize multi-threaded CPU/GPU intensive operations and may connect to external model repositories (e.g., Hugging Face, AWS S3) via specific ports, triggering the coinminer network heuristic.