Abstract: Provided are a method and apparatus for identifying a malicious mining behavior, an electronic device, and a storage medium. The method includes: obtaining operation data corresponding to a target operation, on capturing of the target operation; extracting a wallet address from the operation data to obtain a wallet address set obtaining data of a network outgoing connection for external access, and determining whether the data of the network outgoing connection comprises a wallet address belonging to the wallet address set and determining that the data of the network outgoing connection corresponds to the malicious mining behavior, on determining that the data of the network outgoing connection comprises a wallet address belonging to the wallet address set.