This hypothesis targets the presence of known Mirai botnet indicators of compromise, which are frequently used to establish command-and-control channels or facilitate distributed denial-of-service attacks against network infrastructure. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify compromised assets early, preventing the botnet from scaling its attack surface and impacting cloud service availability.
Malware Family: Mirai Total IOCs: 42 IOC Types: sha256_hash
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| sha256_hash | 4e4d0871610d78af5a83f953922d678d75f5ca1b3e2720d4603231e3ed74349f | payload | 2026-09-13 | 100% |
| sha256_hash | 3644b04cd4993fc39baef2ea93c86e5265b92ea59c976d2067d694867ff4dc22 | payload | 2026-09-13 | 100% |
| sha256_hash | 862dd33cb3171e720b6d89da5bc4b79128024506071f5b3f01fa23e49f535ed2 | payload | 2026-09-13 | 100% |
| sha256_hash | e4d73e95210d4a8447c574a0a740b8ac10950a2365bb3cce79d34d1c09fc6f52 | payload | 2026-09-13 | 100% |
| sha256_hash | f76b038b85f69142fe80b5a143b9f491cf0761988056d5b3eb3537b675c2f90f | payload | 2026-09-13 | 100% |
| sha256_hash | fff6115ec1aec9c80336fb0cd2b8699a1827947ca8841ced3b824edb03c63694 | payload | 2026-09-13 | 100% |
| sha256_hash | c524830daa732b0046429a0ef1799f5d4ffae7c38730f8167f5f1d3028499264 | payload | 2026-09-13 | 100% |
| sha256_hash | 0021410301049ec24e82383e18d91e9d5a48f3bcd652a202b3b8575027024ee7 | payload | 2026-09-13 | 100% |
| sha256_hash | 824a99f86dfe040a4df41bbc5af8b48070e8926d405d078dca8f54a03de73659 | payload | 2026-09-13 | 100% |
| sha256_hash | 465be896c32b979119f0995df5772237695442d4ac79bc9881df25b0d22035a2 | payload | 2026-09-13 | 100% |
| sha256_hash | 4d80e50e552afd5bbf41ab84d845af4f3c341f70cac63e00aa37dbca91d2dd49 | payload | 2026-09-13 | 100% |
| sha256_hash | 5e27d784da20ccc41f59a67296d2a2ea3fb9a2fa095b2b44b54863a502ed9626 | payload | 2026-09-13 | 100% |
| sha256_hash | b78851a867a3438bf847dabd817f966222bf7ccc742e97e3187bec81208e42a4 | payload | 2026-09-13 | 100% |
| sha256_hash | c48a8fd580df07df4f24e4983f87f02eb12c50deda3f833325073aaedb390b1d | payload | 2026-09-13 | 100% |
| sha256_hash | 1f8acd40f1ce904da7f0cafd1bec78dc421eb72604edc05d3256e4a8ccb425c2 | payload | 2026-09-13 | 100% |
| sha256_hash | b227b11a23fab5a68c54ec3485d054f37b975ab692f9185697ebcc7410221ff2 | payload | 2026-09-13 | 100% |
| sha256_hash | 898572bc8f5738ad0e76d300c6b70e69f000ab5b697c4dcd4a57adf43056f140 | payload | 2026-09-13 | 100% |
| sha256_hash | b1e7123c09c5cc0d00ba274aa17f7f0c6b1871251063d071398d3199449115b9 | payload | 2026-09-13 | 100% |
| sha256_hash | c630cb386ed061f395b2527513b40f45d5c857637856cdacef856a6b061ff277 | payload | 2026-09-13 | 100% |
| sha256_hash | 34307d43ad3de41e8913fead533bc27f33e458b83f0107053b822fbb5a6f1c57 | payload | 2026-09-13 | 100% |
| sha256_hash | 691a464914194f0afc7524c2b1e4b555c28acbbc8ac8ce7c33d461f3806084ec | payload | 2026-09-13 | 100% |
| sha256_hash | f6436608095cd0d25dde490e6ce7b23c9bad762f278efae6aa0201a9a68b3cba | payload | 2026-09-13 | 100% |
| sha256_hash | c9f1898be5497409f06688f413d277d3391ee1f4406b16a611bdcce761c04930 | payload | 2026-09-13 | 100% |
| sha256_hash | 9c3d18dac0e9364bbb11423f3f1c1f58535d1ede52751b078a1c5e73b653c4bb | payload | 2026-09-13 | 100% |
| sha256_hash | 1fe41e8a4f1dfe024f2b184c5108f38af1199fbce4875fc979de4451681af566 | payload | 2026-09-13 | 100% |
// Hunt for files matching known malicious hashes
// Source: ThreatFox - Mirai
let malicious_hashes = dynamic(["4e4d0871610d78af5a83f953922d678d75f5ca1b3e2720d4603231e3ed74349f", "3644b04cd4993fc39baef2ea93c86e5265b92ea59c976d2067d694867ff4dc22", "862dd33cb3171e720b6d89da5bc4b79128024506071f5b3f01fa23e49f535ed2", "e4d73e95210d4a8447c574a0a740b8ac10950a2365bb3cce79d34d1c09fc6f52", "f76b038b85f69142fe80b5a143b9f491cf0761988056d5b3eb3537b675c2f90f", "fff6115ec1aec9c80336fb0cd2b8699a1827947ca8841ced3b824edb03c63694", "c524830daa732b0046429a0ef1799f5d4ffae7c38730f8167f5f1d3028499264", "0021410301049ec24e82383e18d91e9d5a48f3bcd652a202b3b8575027024ee7", "824a99f86dfe040a4df41bbc5af8b48070e8926d405d078dca8f54a03de73659", "465be896c32b979119f0995df5772237695442d4ac79bc9881df25b0d22035a2", "4d80e50e552afd5bbf41ab84d845af4f3c341f70cac63e00aa37dbca91d2dd49", "5e27d784da20ccc41f59a67296d2a2ea3fb9a2fa095b2b44b54863a502ed9626", "b78851a867a3438bf847dabd817f966222bf7ccc742e97e3187bec81208e42a4", "c48a8fd580df07df4f24e4983f87f02eb12c50deda3f833325073aaedb390b1d", "1f8acd40f1ce904da7f0cafd1bec78dc421eb72604edc05d3256e4a8ccb425c2", "b227b11a23fab5a68c54ec3485d054f37b975ab692f9185697ebcc7410221ff2", "898572bc8f5738ad0e76d300c6b70e69f000ab5b697c4dcd4a57adf43056f140", "b1e7123c09c5cc0d00ba274aa17f7f0c6b1871251063d071398d3199449115b9", "c630cb386ed061f395b2527513b40f45d5c857637856cdacef856a6b061ff277", "34307d43ad3de41e8913fead533bc27f33e458b83f0107053b822fbb5a6f1c57", "691a464914194f0afc7524c2b1e4b555c28acbbc8ac8ce7c33d461f3806084ec", "f6436608095cd0d25dde490e6ce7b23c9bad762f278efae6aa0201a9a68b3cba", "c9f1898be5497409f06688f413d277d3391ee1f4406b16a611bdcce761c04930", "9c3d18dac0e9364bbb11423f3f1c1f58535d1ede52751b078a1c5e73b653c4bb", "1fe41e8a4f1dfe024f2b184c5108f38af1199fbce4875fc979de4451681af566", "fdefb11a39dd231810addbb1e5d210bf7c1fc6ea52466614abbc2e15c7b3fdae", "c61311407e9a31f60807d3cab8d38f254f3d961c4df04906de869415d3fd458e", "5c299c0278faf2fb51febdde019a7f24ea147e6c968b688cb05f7cef4d4f76a0", "8fb4cfabec6fa0b8f0e0d25135e87e88c13c3dce61c1335a89ee2e474a3d1570", "3bc7efeed4bbebc6a515be55736e6726dd3873553b00e70af513f8ab05761422", "565c2198267c0fe3cab574243a426f8ff824a4499522148d5958d53b1cf22fc4", "d77dc5c7c6f4e8afb7713f09164ec720c689bce019c0bf5d2bcc5fafebe11a43", "8fb3f88d43686d2fc353450d9751dc4080c9e32310089b0aedb63636a14bd54f", "4a2e34ffd5ff1f0d0cdaa2db74b8cec724c4b1a6375cb1f8eebd982d98f1fbe5", "3e64858dced7a1eea58505529e3cd3183cd60697e160af45b8f44acb3469657a", "fea2567c15cfa36d7a159525519358c255d73330bd0f9304f2c9557eee002c0c", "d2b5a8abdd33271500c062dae49ea54272ea64da77569d413091bf7209bb6bde", "3f5acbdfe7861fb5b193691c38de3a023c9ee7473fb0debd69e134a9a45fe421", "0f9f3634949e0632da172e33c8a63172cfe4feba72f38020d6a1b7bffda21ae0", "fc16acc4bd3243ec0ac36920f73ae9283ec1d767ace3fcd645a095cc653963d1", "ff48aa6b57feea8fa9c26b3acb35c9d5636a5830d17320daf26b00bc1e0860a4", "23fcc1ee227bee8ecb236bfeff502d7ff46e47ceacc3846fb65c5161c613c1cb"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
DeviceFileEvents | Ensure this data connector is enabled |
Legacy IoT Device Firmware Updates: Mirai IOCs often include specific IP addresses or hash values associated with default credentials or known botnet nodes. In environments with unmanaged or legacy IoT devices (e.g., IP cameras, smart thermostats, or industrial controllers) that perform periodic firmware updates or communicate with specific vendor update servers, these connections may match the IOC list.
*.vendor-update.com) if the devices are segmented in a dedicated IoT VLAN and have been verified as patched.Security Testing and Penetration Exercises: During internal penetration tests or red team engagements, testers may intentionally deploy Mirai variants or use tools that reference Mirai-specific IOCs (such as specific port scans on 23/2323 or known Mirai binary hashes) to validate detection coverage. These legitimate activities will trigger the hunt package.
Backup and Restore Operations: Mirai IOCs may include file hashes or specific directory paths (e.g., /tmp/.mirai or specific binary names). During large-scale backup jobs or disaster recovery drills, backup agents (like Veeam, Commvault, or Acronis) may temporarily stage files or create temporary directories that match Mirai naming conventions or hash values, especially if restoring from an older image that contained a known Mirai-infected file.
VeeamBackup.exe, `commvault.exe