This hunt targets the presence of known Mirai botnet indicators, which adversaries use to establish command-and-control channels or execute brute-force attacks against IoT and Linux devices. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify compromised assets early, preventing the rapid propagation of the botnet and mitigating the risk of large-scale DDoS attacks or lateral movement within the environment.
Malware Family: Mirai Total IOCs: 23 IOC Types: ip:port, sha256_hash
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| sha256_hash | 6e748948aa9230adda8fb8a7c7d2c5c58db8d1cd4893e0a92fe8942667610c19 | payload | 2026-09-12 | 100% |
| sha256_hash | 880a9ea4c0bfcff656613559449a906f3da211c977fb8e29927b33322ccdd6dc | payload | 2026-09-12 | 100% |
| sha256_hash | f861d7e59442efac50facae40330c67fab8f2bfe6dea622118bfd1dc68a238dd | payload | 2026-09-12 | 100% |
| sha256_hash | daf6ffa16e4e18c9da8a8e8471ef4950a85c6a648f9f53a9c2db855a0404d9e4 | payload | 2026-09-12 | 100% |
| sha256_hash | 01d8dc569e88dee98c53c19e687d67c5596215dc32f6cb618b8179621a422373 | payload | 2026-09-12 | 100% |
| sha256_hash | 4c09665a7fe8894c792d6bbc72a0c40884b72363b56b3bef2b2c651f8d5b9f01 | payload | 2026-09-12 | 100% |
| sha256_hash | b145c4512a72ff02c951da3b3d57273c3a9404f4fb691ccaa2750e6bb65f0a6f | payload | 2026-09-12 | 100% |
| sha256_hash | 2350b755685fc663fc5b0758d90ca576d256f5730ac182c611a4ddc0dfce0d04 | payload | 2026-09-12 | 100% |
| sha256_hash | 9b717d713836c386fd57e786ff5ea94b51216d1f588452a1866d6f66f7e9ba01 | payload | 2026-09-12 | 100% |
| sha256_hash | c502a9629f7965bd776de4de6edd5e8ca39d4b733e1f9d1e7cbadc7875c3eb6b | payload | 2026-09-12 | 100% |
| sha256_hash | 30021ebe609908ad9b5a42a38b9be1e83225a86f2b7c15b77dc7ec91e016dff2 | payload | 2026-09-12 | 100% |
| sha256_hash | 5f758bff42f922c84f0da94565961a1f66a144f509292a9f32fb588acb09dffd | payload | 2026-09-12 | 100% |
| sha256_hash | a69adca11b2ae199c00bd0d3d74535bb5aa3680b7e0de357f3d3c1428fb29aaa | payload | 2026-09-12 | 100% |
| sha256_hash | 4a8c9a0a8c736d0fcf011d085089fd4bb1f57a527e4a40742b9464d5b38ea741 | payload | 2026-09-12 | 100% |
| sha256_hash | da7ffe7578fbd4434eb90191c71d9009656c8d0ee1e042714c450ba8ee8e8486 | payload | 2026-09-12 | 100% |
| sha256_hash | e2bd2df04d99a41fbf40500e1de3fbf3c69a5ad952e4d23102d22d6de1246138 | payload | 2026-09-12 | 100% |
| sha256_hash | d75b9a8289eda8d48ff22e483f6df819d6a3e2d3fe638f6cb986d74358fe6e8e | payload | 2026-09-12 | 100% |
| sha256_hash | 0dde7f3ddfe8924aa019bc2f8204aa6205aa8c04fec5b7c3284e6424b0aab204 | payload | 2026-09-12 | 100% |
| sha256_hash | 9d8a4cd741ff9f08ea00c04c7c90a0a1451c0e12fa25c1b098f2b27863819cfa | payload | 2026-09-12 | 100% |
| sha256_hash | 9613957243feee5856b463939fab394765d6c9d8231c6c96a8f81ff1fb8925e5 | payload | 2026-09-12 | 100% |
| sha256_hash | 36fd38fb3bde624b67d2e7be824a7da3b552326f8ad203976d49dfb87e4b3547 | payload | 2026-09-12 | 100% |
| sha256_hash | b76e9c4be46dd696a998d2eef5a0a5228c713d7b659358ef08cc647ab98845db | payload | 2026-09-12 | 100% |
| ip:port | 93[.]152[.]221[.]22:3778 | botnet_cc | 2026-09-12 | 80% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Mirai
let malicious_ips = dynamic(["93.152.221.22"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["93.152.221.22"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc// Hunt for files matching known malicious hashes
// Source: ThreatFox - Mirai
let malicious_hashes = dynamic(["6e748948aa9230adda8fb8a7c7d2c5c58db8d1cd4893e0a92fe8942667610c19", "880a9ea4c0bfcff656613559449a906f3da211c977fb8e29927b33322ccdd6dc", "f861d7e59442efac50facae40330c67fab8f2bfe6dea622118bfd1dc68a238dd", "daf6ffa16e4e18c9da8a8e8471ef4950a85c6a648f9f53a9c2db855a0404d9e4", "01d8dc569e88dee98c53c19e687d67c5596215dc32f6cb618b8179621a422373", "4c09665a7fe8894c792d6bbc72a0c40884b72363b56b3bef2b2c651f8d5b9f01", "b145c4512a72ff02c951da3b3d57273c3a9404f4fb691ccaa2750e6bb65f0a6f", "2350b755685fc663fc5b0758d90ca576d256f5730ac182c611a4ddc0dfce0d04", "9b717d713836c386fd57e786ff5ea94b51216d1f588452a1866d6f66f7e9ba01", "c502a9629f7965bd776de4de6edd5e8ca39d4b733e1f9d1e7cbadc7875c3eb6b", "30021ebe609908ad9b5a42a38b9be1e83225a86f2b7c15b77dc7ec91e016dff2", "5f758bff42f922c84f0da94565961a1f66a144f509292a9f32fb588acb09dffd", "a69adca11b2ae199c00bd0d3d74535bb5aa3680b7e0de357f3d3c1428fb29aaa", "4a8c9a0a8c736d0fcf011d085089fd4bb1f57a527e4a40742b9464d5b38ea741", "da7ffe7578fbd4434eb90191c71d9009656c8d0ee1e042714c450ba8ee8e8486", "e2bd2df04d99a41fbf40500e1de3fbf3c69a5ad952e4d23102d22d6de1246138", "d75b9a8289eda8d48ff22e483f6df819d6a3e2d3fe638f6cb986d74358fe6e8e", "0dde7f3ddfe8924aa019bc2f8204aa6205aa8c04fec5b7c3284e6424b0aab204", "9d8a4cd741ff9f08ea00c04c7c90a0a1451c0e12fa25c1b098f2b27863819cfa", "9613957243feee5856b463939fab394765d6c9d8231c6c96a8f81ff1fb8925e5", "36fd38fb3bde624b67d2e7be824a7da3b552326f8ad203976d49dfb87e4b3547", "b76e9c4be46dd696a998d2eef5a0a5228c713d7b659358ef08cc647ab98845db"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceFileEvents | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Scenario: A network operations center (NOC) engineer runs a routine vulnerability scan using Nessus or Qualys against the internal IP range, which includes the Mirai IOCs (e.g., specific ports like 23, 2323, or 2333) to verify patch levels. The scanner actively probes these known botnet ports, triggering the IOC match.
Nessus-Scanner or Qualys-Agent service accounts, or exclude the specific port numbers if the scan is scheduled during a maintenance window.Scenario: A DevOps team deploys a legacy IoT device management service (e.g., OpenWrt or a custom Python script) that listens on port 2323 for device configuration updates. The service binds to this port as part of its standard protocol, matching the Mirai IOC.
device-mgr.py or openwrt-agent) and the associated service account, or whitelist the specific hostnames running this legacy service.Scenario: An IT administrator performs a manual connectivity test using Telnet or Netcat (nc) to verify that a new firewall rule allows traffic to a specific internal service that happens to use port 23 (Telnet) or 2323. The connection attempt creates a network event matching the IOC.
IT-Admins group and the destination port is 23 or 2323, provided the connection duration is less than 30 seconds (indicating a test rather than a persistent connection).Scenario: A security team runs a **Y