ThreatFox: Mirai IOCs

Hunt Hypothesis

This rule detects the presence of known Mirai botnet indicators of compromise, which adversaries use to establish footholds and propagate across IoT and server assets. Proactively hunting for these IOCs in Azure Sentinel is critical to identify compromised endpoints early, as Mirai is frequently leveraged for large-scale DDoS attacks and lateral movement within enterprise networks.

IOC Summary

Malware Family: Mirai Total IOCs: 2 IOC Types: sha256_hash, ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Mirai
let malicious_ips = dynamic(["87.58.201.21"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["87.58.201.21"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Mirai
let malicious_hashes = dynamic(["ff69af09f1dba3c4ede99a5f5837ddff5ac3cb71621d4cd3f2da11e30fe2eab9"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Mirai

False Positive Guidance

• Scenario: A network administrator uses nmap or masscan to perform routine vulnerability scanning or asset discovery against internal subnets, triggering port scan IOCs (e.g., common Mirai ports like 23, 5555, or 2323) that are part of the hunt package.

  • Filter/Exclusion: Exclude source IPs belonging to the designated “Scanning Team” or “Network Operations” security group, or filter out events where the destination port matches a known internal service port (e.g., 5555 for VNC) if the source is a management server.

• Scenario: Developers or DevOps engineers run containerized CI/CD pipelines or local test environments that include legacy IoT firmware images or specific Mirai botnet test harnesses for integration testing, causing the host to exhibit Mirai-like behavioral IOCs (e.g., specific string matches in memory or process arguments).

  • Filter/Exclusion: Exclude hosts tagged with Environment: Dev or Project: IoT-Testing, or filter out processes originating from specific container runtimes (e.g., docker, podman) or directories like /opt/ci/ and /var/lib/docker/.

• Scenario: A legacy IoT device (e.g., IP camera, smart thermostat) running outdated firmware communicates with a known Mirai C2 IP or uses a common Mirai port for its native protocol, triggering network connection IOCs.

  • Filter/Exclusion: Exclude source IPs from the “IoT Devices” or “OT Network” VLAN range, or whitelist specific device MAC addresses/OUIs associated with known vendors (e.g., Hikvision, Axis) if they are confirmed to use these ports legitimately.

• Scenario: A security team performs a red team exercise or purple team drill, intentionally deploying a Mirai variant or mim