ThreatFox: Mirai IOCs

Hunt Hypothesis

This hypothesis targets the presence of known Mirai botnet indicators, which adversaries deploy to establish command-and-control channels or execute distributed denial-of-service attacks against network assets. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify compromised endpoints or exposed services before the botnet can scale its operations or pivot within the environment.

IOC Summary

Malware Family: Mirai Total IOCs: 2 IOC Types: domain, ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Mirai
let malicious_ips = dynamic(["94.154.43.38"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["94.154.43.38"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Mirai
let malicious_domains = dynamic(["nyxis.lol"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — Mirai

False Positive Guidance

• Scenario: A network operations center (NOC) engineer performs a routine health check on edge firewalls or load balancers using nmap or masscan to verify that specific Mirai-associated ports (e.g., 23, 5683, 9000) are open or closed as expected.

  • Filter/Exclusion: Exclude source IPs belonging to the NOC-Management or Lab-Testing VLANs, or filter out events where the destination port matches the known Mirai IOCs but the source user is a service account like svc_noc_monitor.

• Scenario: An IT administrator runs a scripted PowerShell or Bash job during a quarterly patching cycle that explicitly checks for the presence of the telnet service or specific binary hashes associated with Mirai variants on legacy IoT devices or embedded systems that have not yet been migrated to modern protocols.

  • Filter/Exclusion: Exclude hosts tagged with Legacy-IoT or Embedded-Systems in the asset inventory, or filter out detection events where the process name is powershell.exe or bash and the command line contains keywords like Get-Service or systemctl status telnet.

• Scenario: A security team conducts a tabletop exercise or a live-fire simulation to validate their Mirai detection coverage, intentionally spawning a benign process or connecting to a test server using the specific IOCs (e.g., a test telnet connection to a known internal IP).

  • Filter/Exclusion: Exclude events occurring within a designated time window (e.g., 02:00-04:00 UTC) or filter out source IPs from the Security-Testing subnet, ensuring the destination IP is not a production-critical asset.

• Scenario: A CI/CD pipeline runs integration tests