ThreatFox: xmrig IOCs

Hunt Hypothesis

This hunt targets the presence of known IOCs associated with the XMRig cryptocurrency miner, indicating that an adversary has likely deployed a resource-intensive process to steal computational power for mining. Proactively hunting for these indicators in Azure Sentinel is critical to identify and isolate compromised workloads before the miner degrades system performance or signals a broader compromise.

IOC Summary

Malware Family: xmrig Total IOCs: 13 IOC Types: sha256_hash, ip:port, url

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - xmrig
let malicious_ips = dynamic(["193.181.209.137", "80.74.30.4", "208.167.233.7"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["193.181.209.137", "80.74.30.4", "208.167.233.7"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - xmrig
let malicious_urls = dynamic(["http://80.74.30.4:3000/sparky/comfyui-utils.git", "http://165.245.138.247:81/private/rigel-win.zip", "http://165.245.138.247:81/private/xmrig-win.zip", "http://217.76.63.67:81/private/xmrig-win.zip", "http://217.76.63.67:81/private/rigel-win.zip", "http://103.249.201.108:81/private/xmrig-win.zip", "http://103.249.201.108:81/private/rigel-win.zip"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - xmrig
let malicious_hashes = dynamic(["6fa80698d7268f6e88aa88c06fb27ee99e1bcee747c2e76911e6206a5b1aeeb3", "0a813de910c312b2a0206a75ccf6f0f329690ff7e706d2e0f954b540c68fe8f3", "b9df548d6214aa93b685c981fd4c39185fd9ef55933f17da1a0d7fe9321107e1"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — xmrig

False Positive Guidance

• Legitimate CPU Stress Testing by Performance Engineering Team

  • Scenario: The Performance Engineering team uses xmrig as a lightweight, cross-platform CPU stress-testing tool to benchmark new server hardware or validate thermal throttling behavior before deployment. They run it via a scheduled PowerShell script on staging VMs during off-hours.
  • Filter/Exclusion: Exclude alerts where the process path is located in a known test directory (e.g., C:\PerfTest\bin\) or where the parent process is a known test runner (e.g., powershell.exe with arguments containing -Test or -Benchmark).

• CI/CD Pipeline Build Agents Running Containerized Tests

  • Scenario: In a Kubernetes-based CI/CD pipeline, a build agent spins up ephemeral containers for unit testing. One of the test containers includes xmrig in its base image (often due to a shared base image for compute-intensive tasks) and executes it briefly to validate resource limits.
  • Filter/Exclusion: Exclude alerts where the process is running inside a containerized environment (e.g., containerid present in Sysmon Event ID 1) and the parent process is a container runtime like dockerd or containerd-shim.

• Legacy Application Dependency in Development Environments

  • Scenario: A legacy internal web application in the development environment has a dependency on a third-party library that bundles xmrig for background data compression or hashing tasks. Developers run this application locally on their workstations, which are often less strictly monitored than production servers.
  • Filter/Exclusion: Exclude alerts on endpoints tagged as Dev or Test in your CMDB, or exclude if the process is launched by a known development IDE (e.g., code.exe, idea64.exe) or a local