ThreatFox: XMRIG IOCs | SOC Hunt Feed

Hunt Hypothesis

This hunt targets adversary behavior involving the deployment of XMRIG cryptocurrency miners, which often serve as indicators of initial compromise or resource hijacking within Azure environments. Proactively hunting for these specific IOCs in Azure Sentinel is critical to identify silent cryptojacking campaigns before they significantly degrade system performance and incur unexpected cloud costs.

IOC Summary

Malware Family: XMRIG Total IOCs: 8 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`116[.]62[.]220[.]96:6379`	payload_delivery	2026-07-01	80%
ip:port	`172[.]86[.]90[.]30:6379`	payload_delivery	2026-07-01	80%
ip:port	`120[.]77[.]79[.]42:6379`	payload_delivery	2026-07-01	80%
ip:port	`34[.]140[.]219[.]200:6379`	payload_delivery	2026-07-01	80%
ip:port	`34[.]38[.]119[.]76:6379`	payload_delivery	2026-07-01	80%
ip:port	`8[.]137[.]157[.]150:6379`	payload_delivery	2026-07-01	80%
ip:port	`193[.]32[.]126[.]228:5432`	payload_delivery	2026-07-01	80%
ip:port	`141[.]98[.]100[.]14:5432`	payload_delivery	2026-07-01	80%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - XMRIG
let malicious_ips = dynamic(["172.86.90.30", "120.77.79.42", "141.98.100.14", "193.32.126.228", "116.62.220.96", "34.140.219.200", "34.38.119.76", "8.137.157.150"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["172.86.90.30", "120.77.79.42", "141.98.100.14", "193.32.126.228", "116.62.220.96", "34.140.219.200", "34.38.119.76", "8.137.157.150"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — XMRIG

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: XMRIG IOCs detection rule in an enterprise environment, along with suggested filters or exclusions:

Containerized Development Environments (Docker/Kubernetes)
- Scenario: Developers frequently run local containers using docker run commands that pull images containing pre-installed mining binaries for performance testing. Specifically, CI/CD pipelines often spin up ephemeral containers running XMRIG to benchmark CPU utilization before deployment.
- Filter/Exclusion: Exclude processes originating from the Docker container runtime (e.g., containerd-shim, dockerd) where the parent process is a known build agent (e.g., jenkins-agent.exe or gitlab-runner.exe). Additionally, filter out network connections to XMRIG pool IPs if the source IP belongs to the internal “Dev-Test” subnet.
IT Asset Management & Hardware Benchmarking
- Scenario: The IT Operations team utilizes automated scheduled tasks (Task Scheduler on Windows or Cron on Linux) to run hardware health checks and CPU stress tests on new server fleets. Tools like Sysbench, Prime95, or custom scripts invoking XMRIG are used to validate thermal throttling and memory integrity during the “burn-in” phase of new hardware procurement.
- Filter/Exclusion: Create an exclusion for processes launched by the specific service account responsible for asset management (e.g., svc-hardware-check) and restrict the rule trigger to only alert if the process path is outside the designated “Benchmarking Tools” directory (e.g., C:\Program Files\ITOps\StressTests).
Cloud Infrastructure Monitoring Agents
- Scenario: Enterprise cloud management platforms, such as Datadog, New Relic, or SolarWinds, often deploy lightweight agents that include