ThreatFox: Mirai IOCs

Hunt Hypothesis

This hunt hypothesis targets the presence of known Mirai malware indicators of compromise, which signal that an adversary has successfully compromised IoT devices to establish a foothold for large-scale DDoS attacks. Proactively hunting for these IOCs in Azure Sentinel is critical to identify and isolate infected endpoints before they are leveraged to amplify traffic and disrupt network availability.

IOC Summary

Malware Family: Mirai Total IOCs: 4 IOC Types: ip:port, url

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Mirai
let malicious_ips = dynamic(["94.154.43.69"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["94.154.43.69"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Mirai
let malicious_urls = dynamic(["http://vps.atlas101.us.kg", "http://loveher.dpdns.org", "http://langec.jewmailer.net:7768"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Mirai

False Positive Guidance

• Scenario: IoT Firmware Update via SSH

  • Description: A network operations engineer uses ssh to connect to a fleet of IP cameras or smart switches to push a firmware update. The Mirai family often exploits weak SSH credentials or known vulnerabilities (like the telnet backdoor), so legitimate administrative SSH connections to IoT subnets can mimic the initial access vector.
  • Filter/Exclusion: Exclude source IPs from the designated “IoT Management” VLAN or exclude connections where the destination port is 22 (SSH) and the source IP belongs to the 10.20.0.0/24 (IoT Mgmt) range.

• Scenario: Scheduled Cron Job for Log Rotation on Embedded Devices

  • Description: Many IoT devices (e.g., routers, NAS units) run lightweight Linux distributions that use cron jobs for maintenance tasks like log rotation or cache clearing. If the detection rule triggers on specific process names or file paths associated with Mirai’s persistence mechanisms, these standard system maintenance jobs may be flagged.
  • Filter/Exclusion: Exclude processes where the parent process is cron or crond and the executable path matches /usr/bin/ or /bin/ standard system directories, specifically excluding paths containing /tmp/ or /var/tmp/ unless the process name is not a standard binary (e.g., sh, bash, python).

• Scenario: Port Scanning by Internal Security Tools

  • Description: Internal vulnerability scanners (like Nessus, OpenVAS, or Nmap) routinely scan IoT subnets to identify open ports (such as 23/Telnet, 80/HTTP, 8080/HTTP-Alt) that Mirai exploits. These scans generate connection attempts that match the IOCs for Mirai’s target services.