ThreatFox: Coinminer IOCs

Hunt Hypothesis

This detection identifies adversary behavior where malicious actors deploy cryptocurrency mining software to consume system resources and generate unauthorized network traffic via specific ThreatFox indicators of compromise. Proactively hunting for these coinminer signatures in Azure Sentinel is critical to prevent performance degradation on production workloads and to detect early-stage lateral movement before resource exhaustion impacts business operations.

IOC Summary

Malware Family: Coinminer Total IOCs: 3 IOC Types: sha1_hash, sha256_hash, md5_hash

Type	Value	Threat Type	First Seen	Confidence
md5_hash	`1ccf41cfd9d85a0e6c49854e25d76ab5`	payload	2026-06-29	95%
sha256_hash	`3f076a3e4a0733c630d58f790dc8b6422c5ee6344695f88987b14a060d721d4f`	payload	2026-06-29	95%
sha1_hash	`f2a03400898271b8fb6310151c56edf1120b736c`	payload	2026-06-29	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Coinminer
let malicious_hashes = dynamic(["1ccf41cfd9d85a0e6c49854e25d76ab5", "3f076a3e4a0733c630d58f790dc8b6422c5ee6344695f88987b14a060d721d4f", "f2a03400898271b8fb6310151c56edf1120b736c"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Coinminer

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Coinminer IOCs detection rule in an enterprise environment, along with recommended filters or exclusions:

Legitimate Software Updates via Package Managers
- Scenario: System administrators use tools like Chocolatey, Ansible, or SCCM (System Center Configuration Manager) to deploy updates for development environments. These packages often include open-source mining libraries (e.g., ccminer, cgminer) as dependencies for testing blockchain integration modules, triggering the IOCs during installation or dependency resolution.
- Filter/Exclusion: Exclude processes originating from known package management tools (choco.exe, ansible-playbook, ccmexec.exe) and restrict alerts to non-standard directories (e.g., exclude paths under C:\Program Files\Chocolatey or D:\Ansible).
Scheduled Antivirus Definition Updates
- Scenario: Enterprise endpoint protection solutions like CrowdStrike, SentinelOne, or Microsoft Defender for Endpoint perform scheduled definition updates. The update mechanism often downloads and stages large binary files containing heuristic signatures that match Coinminer network traffic patterns (specifically UDP/HTTP connections to known mining pool IPs) before the actual scan begins.
- Filter/Exclusion: Create an exclusion based on the parent process of the IOCs; specifically, whitelist child processes spawned by C:\Program Files\Microsoft Defender\MsMpEng.exe or C:\Program Files\CrowdStrike\csfalcon.exe.
DevOps CI/CD Pipeline Execution
- Scenario: In a DevOps environment, build agents (e.g., Jenkins, GitLab Runners, or Azure DevOps) execute automated scripts to test containerized applications. These pipelines frequently pull Docker images from registries that include Coinminer binaries for