This hypothesis targets the presence of known Mirai botnet indicators, which adversaries use to establish command-and-control channels or propagate malware across the network. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify compromised assets early, preventing the Mirai botnet from leveraging them for large-scale DDoS attacks or lateral movement before it escalates.
Malware Family: Mirai Total IOCs: 4 IOC Types: url, sha256_hash, ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 94[.]154[.]43[.]88:4330 | botnet_cc | 2026-09-04 | 80% |
| ip:port | 94[.]154[.]43[.]88:44321 | botnet_cc | 2026-09-04 | 80% |
| url | hxxp://2[.]26[.]124[.]67:889/agustin51 | payload_delivery | 2026-09-04 | 75% |
| sha256_hash | 7967790ef8f975fbc7327d575e13f6ce497b7948c42264531bcd4fcaa47ba6a9 | payload | 2026-09-04 | 80% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Mirai
let malicious_ips = dynamic(["94.154.43.88"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["94.154.43.88"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc// Hunt for access to known malicious URLs
// Source: ThreatFox - Mirai
let malicious_urls = dynamic(["http://2.26.124.67:889/agustin51"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc// Hunt for files matching known malicious hashes
// Source: ThreatFox - Mirai
let malicious_hashes = dynamic(["7967790ef8f975fbc7327d575e13f6ce497b7948c42264531bcd4fcaa47ba6a9"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceFileEvents | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
UrlClickEvents | Ensure this data connector is enabled |
Scenario: A network administrator uses nmap or masscan to perform routine vulnerability scanning or asset discovery against internal subnets, generating high-volume connection attempts that match Mirai’s brute-force scanning behavior.
NetOps or SecurityTeam service accounts and known scanner hostnames (e.g., scan-01.corp.local) from the detection logic, or filter out events where the destination port is in the standard service range (21, 22, 23, 80, 443, 554, 10000-10010) but the source is a registered management server.Scenario: A CI/CD pipeline or automated deployment script (e.g., using Ansible or Puppet) pushes configuration updates to a fleet of IoT devices or edge gateways, resulting in a burst of SSH or Telnet connections from a single build server to multiple targets.
CI-CD-Build server IP range or specific service accounts (e.g., svc-deploy) when the destination hosts are tagged with the IoT-Edge or Gateway asset class in the CMDB.Scenario: A legacy application server running an outdated service (e.g., an old ftpd or telnetd daemon) is being probed by an internal monitoring agent (e.g., Zabbix or Nagios) that performs active health checks by attempting to establish connections to verify service availability.
Monitoring-Agents or filter out events where the source port is ephemeral but the destination is a known legacy server IP, specifically if the connection frequency align