This hunt targets known Mirai botnet indicators to identify compromised IoT or embedded devices that may be actively participating in DDoS attacks or serving as entry points for lateral movement. Proactively hunting for these IOCs in Azure Sentinel is critical to detect stealthy, low-and-slow botnet infections that often evade traditional perimeter defenses and can rapidly scale to disrupt cloud infrastructure availability.
Malware Family: Mirai Total IOCs: 3 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 37[.]16[.]74[.]19:80 | botnet_cc | 2026-09-08 | 75% |
| ip:port | 176[.]65[.]139[.]154:80 | botnet_cc | 2026-09-08 | 75% |
| ip:port | 150[.]40[.]127[.]145:3778 | botnet_cc | 2026-09-08 | 80% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Mirai
let malicious_ips = dynamic(["176.65.139.154", "150.40.127.145", "37.16.74.19"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["176.65.139.154", "150.40.127.145", "37.16.74.19"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Scenario: A network operations center (NOC) engineer uses nmap or masscan to perform routine vulnerability scanning or asset discovery against internal subnets, inadvertently hitting the specific IP ranges or ports associated with Mirai’s UDP scanning behavior.
NOC-Scanners security group or specific management VLANs (e.g., 10.20.0.0/24) from triggering alerts when the destination is an internal host, unless the destination is a known critical asset.Scenario: An automated backup solution (e.g., Veeam or Commvault) initiates high-volume UDP traffic or specific port scans as part of its pre-backup connectivity verification or deduplication fingerprinting process, matching the IOCs for Mirai’s port scanning patterns.
Backup-Servers subnet (e.g., 10.30.10.0/24) when the destination port is one of the Mirai-associated ports (e.g., 23, 5555, 10001) and the source is a known backup appliance.Scenario: A DevOps team deploys a containerized microservice that includes a health check script using nc (netcat) or a custom Python script to probe specific UDP ports for service availability, which coincides with Mirai’s default port list (e.g., 23, 5555, 10001).
python, nc, or healthcheck.sh and the source container belongs to the prod-microservices Kubernetes namespace, provided the destination is an internal service endpoint.