ThreatFox: Mirai IOCs | SOC Hunt Feed

Hunt Hypothesis

This rule identifies network traffic or host artifacts matching known Internet of Things (IoT) indicators of compromise associated with the Mirai botnet, a prevalent threat that leverages vulnerable devices to launch distributed denial-of-service attacks. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to detect compromised endpoints or lateral movement attempts before they are fully leveraged for large-scale attacks or further propagation within the environment.

IOC Summary

Malware Family: Mirai Total IOCs: 2 IOC Types: ip:port

Type	Value	Threat Type	First Seen	Confidence
ip:port	`37[.]221[.]65[.]76:45678`	botnet_cc	2026-09-15	75%
ip:port	`45[.]39[.]33[.]166:8080`	botnet_cc	2026-09-15	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Mirai
let malicious_ips = dynamic(["45.39.33.166", "37.221.65.76"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["45.39.33.166", "37.221.65.76"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled

References

ThreatFox — Mirai

False Positive Guidance

Automated Firmware Update Agents: Enterprise endpoint management tools like Ivanti or Microsoft SCCM may push firmware updates to IoT devices (cameras, smart TVs, routers) that involve downloading binary packages from vendor-specific CDNs. If the vendor’s update server IP or domain overlaps with a known Mirai IOC (e.g., specific CDN ranges), the agent’s download process can trigger the rule.
- Filter/Exclusion: Exclude processes named ccmexec.exe (SCCM) or ivantiagent.exe when the destination IP is within the organization’s internal vendor update subnet or when the user context is a service account (e.g., DOMAIN\svc-ccm).
IoT Device Provisioning Scripts: IT teams often use PowerShell or Python scripts to bulk-provision new IoT devices (e.g., Ubiquiti UniFi controllers or Sonos speakers) by pulling configuration files or firmware blobs from public GitHub repositories or vendor S3 buckets. If the script downloads a file from an IP address listed in the Mirai IOC set, the execution of the download command (e.g., curl or Invoke-WebRequest) can be flagged.
- Filter/Exclusion: Exclude events where the initiating process is powershell.exe or python.exe and the command line contains keywords like provision, firmware, or config, provided the source IP is within a documented allowlist of vendor infrastructure.
Network Monitoring and Packet Capture Tools: Security or network engineering teams using tools like Wireshark or Zeek may replay captured traffic or download sample PCAP files from public threat intelligence repositories (e.g., MalShare, VirusShare) for analysis. If the analysis involves connecting to a public IP that is also a known Mirai C2 or download server, the connection can trigger the rule.