ThreatFox: Coinminer IOCs

Hunt Hypothesis

This detection identifies adversary behavior characterized by the execution of cryptocurrency mining processes that leverage specific ThreatFox indicators to establish a persistent foothold within the environment. A SOC team should proactively hunt for these coinminer IOCs in Azure Sentinel to rapidly detect and mitigate resource exhaustion attacks before they significantly degrade system performance or incur unexpected costs.

IOC Summary

Malware Family: Coinminer Total IOCs: 3 IOC Types: sha256_hash, sha1_hash, md5_hash

Type	Value	Threat Type	First Seen	Confidence
sha256_hash	`52f447218c94376f552d1c2b5bfa01c4ef2b5d32ac9ac061236cd286a9efba67`	payload	2026-07-25	95%
sha1_hash	`b1979a03b72b7ced1fffb9e4dd34e0e01adbfc67`	payload	2026-07-25	95%
md5_hash	`5a59127af8fcd4d20671f83f4ea243a7`	payload	2026-07-25	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Coinminer
let malicious_hashes = dynamic(["52f447218c94376f552d1c2b5bfa01c4ef2b5d32ac9ac061236cd286a9efba67", "b1979a03b72b7ced1fffb9e4dd34e0e01adbfc67", "5a59127af8fcd4d20671f83f4ea243a7"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Coinminer

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: Coinminer IOCs detection rule, along with suggested filters and exclusions tailored for an enterprise environment:

Scheduled Maintenance Jobs on Virtualization Hosts
- Scenario: Enterprise virtualization platforms (e.g., VMware vSphere or Microsoft Hyper-V) often run scheduled maintenance scripts that utilize high CPU resources to analyze host performance. These scripts may spawn processes with names like vpxd.exe or vmware-tools.exe that match the coinminer IOCs due to similar hash signatures or network connections to known update servers.
- Filter/Exclusion: Create a rule exclusion for specific process paths located in standard virtualization installation directories (e.g., C:\Program Files\VMware\*). Additionally, exclude alerts occurring during predefined maintenance windows (e.g., 02:00–04:00 daily) where these jobs are known to execute.
Legitimate IT Asset Discovery and Monitoring Tools
- Scenario: Network monitoring and asset discovery tools such as SolarWinds, Datadog, or Microsoft System Center Configuration Manager (SCCM) frequently deploy agents that scan hardware inventory. These agents often initiate background processes to measure CPU/GPU utilization, which can mimic the behavioral patterns of a coinminer (high resource usage + specific outbound connections).
- Filter/Exclusion: Filter alerts based on the parent process name. If the detected IOC is spawned by known monitoring agents (e.g., SolarWinds.Agent.exe, ccmexec.exe, or datadog-agent), suppress the alert. This can be implemented via a “Parent Process Whitelist” in the SIEM logic.
Software Deployment and Patching Operations
- Scenario: During enterprise-wide patching cycles, tools like **Microsoft Endpoint Configuration Manager (ME