ThreatFox: Mirai IOCs | SOC Hunt Feed

Hunt Hypothesis

This hunt targets the presence of known Mirai botnet indicators of compromise, which often signal compromised IoT devices or servers being leveraged for large-scale DDoS attacks or lateral movement. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify and isolate infected assets before they are fully integrated into the botnet, thereby reducing the risk of sudden network saturation or unexpected outbound traffic spikes.

IOC Summary

Malware Family: Mirai Total IOCs: 13 IOC Types: sha256_hash

Type	Value	Threat Type	First Seen	Confidence
sha256_hash	`410fe1699749582a576c43d760128856be27a6cf04a80c0e3ad880ab41aa7c62`	payload	2026-09-28	95%
sha256_hash	`d01a9d4092a68dd8ef7d75d39feab12fe1309fe77b5cdfaac27ba371a927f864`	payload	2026-09-28	100%
sha256_hash	`13fdcb50766e9fd3ffbb3d19684fa7df0a5b5866b2c7223d2241e15b64a29d3d`	payload	2026-09-28	100%
sha256_hash	`fabcc316d07fb260404b4a64df6af18fbbf4dec23b659ba5833656dad306f7f3`	payload	2026-09-28	95%
sha256_hash	`c55604b959e8c9850dc7124df0a9a1c77e286980de39d6583029949bf4a2d690`	payload	2026-09-28	95%
sha256_hash	`5bdbd8b21e5785c571b2d7adc4959101a18803119bd1d589a5217d8d042e767c`	payload	2026-09-28	95%
sha256_hash	`481ab3406ddfd6b9cf4c9346b4cb815776fd0d89719344247d0d22c8a20e9e57`	payload	2026-09-28	95%
sha256_hash	`652e49116e3235db3fee273a8b9dc904c770c71649db877e97c0b7981d81bcc2`	payload	2026-09-28	100%
sha256_hash	`b18617585fc14db14883e99827c75ac6713c8e56f344b0605ed213a3754e2ce6`	payload	2026-09-28	100%
sha256_hash	`0026d4ecdb0b8eeda2f86c5d8e4442abb5f6601a8976ae1621a44ecbdc202e4e`	payload	2026-09-28	95%
sha256_hash	`1bdabbd4b6ce490592faeaa2f5a45992bb396c52664c8a188aff0955b78a5d75`	payload	2026-09-28	95%
sha256_hash	`5a377ec931f19b8d8848f35dde27211101c7165212309e2065de22a32598506c`	payload	2026-09-28	95%
sha256_hash	`a49c0e59f6fabdceedeff38b5cb81de008594c6121be1f6316998d83ec48dd1c`	payload	2026-09-28	100%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Mirai
let malicious_hashes = dynamic(["410fe1699749582a576c43d760128856be27a6cf04a80c0e3ad880ab41aa7c62", "d01a9d4092a68dd8ef7d75d39feab12fe1309fe77b5cdfaac27ba371a927f864", "13fdcb50766e9fd3ffbb3d19684fa7df0a5b5866b2c7223d2241e15b64a29d3d", "fabcc316d07fb260404b4a64df6af18fbbf4dec23b659ba5833656dad306f7f3", "c55604b959e8c9850dc7124df0a9a1c77e286980de39d6583029949bf4a2d690", "5bdbd8b21e5785c571b2d7adc4959101a18803119bd1d589a5217d8d042e767c", "481ab3406ddfd6b9cf4c9346b4cb815776fd0d89719344247d0d22c8a20e9e57", "652e49116e3235db3fee273a8b9dc904c770c71649db877e97c0b7981d81bcc2", "b18617585fc14db14883e99827c75ac6713c8e56f344b0605ed213a3754e2ce6", "0026d4ecdb0b8eeda2f86c5d8e4442abb5f6601a8976ae1621a44ecbdc202e4e", "1bdabbd4b6ce490592faeaa2f5a45992bb396c52664c8a188aff0955b78a5d75", "5a377ec931f19b8d8848f35dde27211101c7165212309e2065de22a32598506c", "a49c0e59f6fabdceedeff38b5cb81de008594c6121be1f6316998d83ec48dd1c"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Mirai

False Positive Guidance

Scenario: A network operations center (NOC) engineer uses nmap or a custom Python script to perform routine port scanning against internal assets, where the scan targets include the specific IP ranges or ports associated with Mirai’s default botnet communication (e.g., UDP 3232, 3233, 3234, 3235, 3236, 3237, 3238, 3239, 3240, 3241, 3242, 3243, 3244, 3245, 3246, 3247, 3248, 3249, 3250, 3251, 3252, 3253, 3254, 3255, 3256, 3257, 3258, 3259, 3260, 3261, 3262, 3263, 3264, 3265, 3266, 3267, 3268, 3269, 3270, 3271, 3272, 3273, 3274, 3275, 3276, 3277, 3278, 3279, 3280, 3281, 3282, 3283, 3284, 3285, 3286, 3287, 3288,