ThreatFox: Coinminer IOCs

Hunt Hypothesis

This rule detects the presence of known Coinminer indicators of compromise, signaling that an adversary has likely deployed cryptocurrency mining malware to exploit compute resources for financial gain. Proactively hunting for these IOCs in Azure Sentinel is critical to identify and isolate compromised workloads before they consume excessive resources or establish persistence, thereby preventing potential service degradation and unauthorized data exfiltration.

IOC Summary

Malware Family: Coinminer Total IOCs: 2 IOC Types: url, sha256_hash

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Coinminer
let malicious_urls = dynamic(["http://180.148.33.24/Photo.scr"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Coinminer
let malicious_hashes = dynamic(["39d8110c08a16e6e51b2fd7d732638e1dbc06d017ab8ac6b604470d7e7ea244e"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Coinminer

False Positive Guidance

• Legitimate Cryptocurrency Mining for R&D or Edge Computing

  • Scenario: A DevOps or Data Science team runs a legitimate mining client (e.g., xmrig or ethminer) on a specific GPU server or edge device to test blockchain integration, benchmark hardware performance, or support a proof-of-concept for a distributed ledger project. The process name or binary hash matches the IOCs.
  • Filter/Exclusion: Exclude processes where the parent process is a known development tool (e.g., docker, kubectl, python.exe) or restrict the rule to exclude specific “R&D” or “Lab” organizational units (OU) in Active Directory.

• Scheduled Backup or Archiving Jobs Using Cryptographic Hashing

  • Scenario: An enterprise backup solution (e.g., Veeam, Commvault, or Windows Server Backup) executes a scheduled job that calculates SHA-256 or BLAKE2 hashes for data integrity verification. If the detection logic includes hash-based IOCs for specific coinminer binaries, and the backup agent uses a similar hashing library or binary name (e.g., hashcalc.exe or a generic crypto.dll), it may trigger a false positive.
  • Filter/Exclusion: Exclude processes spawned by known backup service executables (e.g., VeeamBackup.exe, commvaultagent.exe) or exclude events where the command line contains specific backup-related arguments (e.g., /verify, /hash, /archive).

• CI/CD Pipeline Build Agents Compiling Cryptographic Libraries

  • Scenario: A Continuous Integration/Continuous Deployment (CI/CD) pipeline (e.g., Jenkins, Azure DevOps, GitHub Actions) compiles or tests open-source cryptographic libraries (e.g., OpenSSL, libsecp256k1) as part of a build step