ThreatFox: Mirai IOCs

Hunt Hypothesis

This hunt targets known Indicators of Compromise (IOCs) associated with the Mirai botnet, which is frequently deployed to establish command-and-control channels or execute distributed denial-of-service attacks against IoT and server assets. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify compromised endpoints early, preventing Mirai from leveraging network infrastructure to amplify attacks or spread laterally before traditional detection mechanisms trigger.

IOC Summary

Malware Family: Mirai Total IOCs: 2 IOC Types: ip:port, domain

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Mirai
let malicious_ips = dynamic(["94.154.43.217"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["94.154.43.217"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Mirai
let malicious_domains = dynamic(["tftp2.sh"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — Mirai

False Positive Guidance

• Scenario: A network operations center (NOC) engineer uses a legacy script or a specific utility like nmap or masscan to perform routine vulnerability scanning or asset discovery against internal IP ranges, inadvertently hitting the specific port or IP pattern associated with the Mirai botnet’s initial propagation mechanism.

  • Filter/Exclusion: Exclude source IPs belonging to the designated NOC-Scanners AD security group or specific jump host subnets (e.g., 10.20.1.0/24) when the destination is an internal RFC1918 address.

• Scenario: An automated CI/CD pipeline or a scheduled PowerShell job (e.g., Invoke-Backup or Sync-Logs) executes a health check or connectivity test by pinging or sending a UDP packet to a known external monitoring endpoint or a specific IoT device range that overlaps with the Mirai IOC IP list.

  • Filter/Exclusion: Exclude events where the process name is powershell.exe or python.exe and the parent process is a recognized CI/CD agent (e.g., jenkins.exe, gitlab-runner.exe) or a scheduled task service (svchost.exe with a specific TaskName).

• Scenario: A developer testing a new IoT gateway or embedded device in a lab environment uses a tool like curl or a custom C# application to send test payloads to a staging server or a public test IP that is part of the ThreatFox Mirai IOC set, often during a dev-test phase.

  • Filter/Exclusion: Exclude source machines tagged with the Azure AD or GPO attribute Environment=Dev or Lab, or exclude processes running from the C:\Projects\IoT-Test\ directory path.

• Scenario: A third-party SaaS backup or log shipping