ThreatFox: xmrig IOCs

Hunt Hypothesis

This detection rule identifies adversary behavior where threat actors deploy the XMRig cryptocurrency miner to covertly exploit victim hardware resources for illicit revenue generation following initial compromise via phishing or supply chain vectors. Proactive hunting in Azure Sentinel is essential to rapidly detect and isolate these resource-draining infections before they significantly degrade system performance or enable lateral movement across the network.

IOC Summary

Malware Family: xmrig Total IOCs: 3 IOC Types: url

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - xmrig
let malicious_urls = dynamic(["http://94.26.106.195:5555", "http://94.26.106.195:80", "http://57.129.119.218:13333"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — xmrig

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: xmrig IOCs detection rule in an enterprise environment, along with suggested filters or exclusions:

• Legitimate DevOps Container Orchestration

  • Scenario: In a Kubernetes or Docker-based development environment, internal CI/CD pipelines (e.g., Jenkins, GitLab Runner) often spin up temporary containers to benchmark hardware performance or validate resource allocation. These containers may execute xmrig binaries as part of standard stress-testing scripts, triggering the rule when they connect to known mining pools for latency checks.
  • Filter/Exclusion: Exclude processes running within specific container namespaces (e.g., k8s.io, docker-desktop) or filter out network connections originating from IP ranges dedicated to DevOps clusters that are whitelisted in the asset inventory.

• Scheduled Hardware Performance Audits

  • Scenario: IT Operations teams utilize automated scheduled jobs (via Windows Task Scheduler or Ansible) to run periodic CPU and memory stress tests on idle workstations during off-hours. These scripts often invoke a lightweight version of xmrig as the benchmarking load generator, mimicking the behavior of an active miner.
  • Filter/Exclusion: Create an exclusion based on the parent process name (e.g., TaskScheduler.exe or ansible-runner) and restrict the alert to only trigger if the execution time falls outside defined maintenance windows (e.g., 02:00–06:00 local time).

• Security Team Malware Research & Sandbox Analysis

  • Scenario: The internal Security Operations Center (SOC) or Threat Intelligence team frequently downloads and analyzes xmrig samples in isolated sandbox environments (such as Cuckoo, Any.Run, or VirusTotal Local) to update detection signatures. During these tests, the malware is intentionally executed, causing