Is the XMRig detection in Windows Defender a false positive?

An XMRig detection in Windows Defender can be a false positive, but you should not assume it is. XMRig is a legitimate mining program, yet attackers also use it to mine on other people’s computers without permission. What matters is whether you deliberately installed it, where it came from, and what else is running alongside it.

Why Defender flags XMRig

XMRig uses your computer’s processor, or CPU, to help mine cryptocurrencies such as Monero. Mining means doing calculations that help secure the network in return for a chance to earn coins.

That same work can happen with or without your permission. Security tools therefore flag some mining software because it is commonly used for cryptojacking: secretly using someone else’s computing power to earn cryptocurrency.

A detection is not always a mistaken identification. Defender may correctly recognize a miner, even when you knowingly installed it. In that situation, the warning can be legitimate while the mining itself is authorized.

The reverse is also important: a genuine copy of XMRig can still be part of an attack if someone installed and configured it without your consent.

Check what triggered the warning

Open Windows Security → Virus & threat protection → Protection history. Expand the relevant alert and look at the detection name, affected file, location, and time. Menu wording can vary slightly by Windows version.

Then ask yourself:

• Did you install XMRig yourself? If not, treat the detection as suspicious.
• Does the file location match your installation? An unexpected copy in a temporary folder or an unfamiliar application folder deserves investigation.
• Did the alert appear after installing something else? A game crack, unofficial installer, or suspicious attachment may have brought it along.
• Does mining start without your approval? Unexplained processor use, loud fans, or mining that returns after removal are warning signs.

A filename alone proves very little. Attackers can rename XMRig or give malicious software a familiar-looking name.

If you knowingly downloaded XMRig

Leave the file quarantined while you check it. Quarantine isolates a detected file so it cannot run normally.

Confirm that your download came from the official XMRig project rather than an advertisement, download mirror, or “guaranteed earnings” package. Where available, compare its SHA-256 checksum—a digital fingerprint of the file—with the checksum published for that release through a trusted source.

A match supports that you have the expected release. It does not prove that your entire computer is clean or that any bundled installer is safe.

Do not switch off Defender or exclude your Downloads folder just to make mining work. If you cannot confidently establish the file’s source and purpose, leave it blocked. Any decision to allow a verified miner should be narrow and limited to software you deliberately chose to run.

If you did not install it

Keep Defender’s protection enabled and let it quarantine or remove the detection. Update its security information, run a full scan, and consider a Microsoft Defender Offline scan, which checks your computer outside the normal Windows session.

If the miner returns, something else may be reinstalling it. Get trusted technical help rather than repeatedly allowing or deleting the same file. On a work or school computer, contact your IT team.

The bottom line

“XMRig detected” does not automatically mean either malware or a harmless false alarm. Your permission, the file’s source, and its behavior determine how you should respond. If you did not knowingly install it, keep it blocked and investigate.