ThreatFox: Mirai IOCs | SOC Hunt Feed

Hunt Hypothesis

This hunt targets the presence of known Mirai botnet indicators of compromise, which are frequently used to establish command-and-control channels or facilitate distributed denial-of-service attacks. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify compromised assets early, preventing the organization from being leveraged as part of a large-scale botnet before significant impact occurs.

IOC Summary

Malware Family: Mirai Total IOCs: 5 IOC Types: sha256_hash

Type	Value	Threat Type	First Seen	Confidence
sha256_hash	`13382c16e2401b07451577b46e634b8031ec254d98b876e59692b5fa22abc1d4`	payload	2026-09-12	50%
sha256_hash	`6fbae3505ae0d638b820165c572d548ce92dda71e82dc47e8efe13f30617f35f`	payload	2026-09-12	50%
sha256_hash	`9d7cd4948a1fcbaeadc425752fce9a933bd6fc41eeede030dffd7b99b3bc51d5`	payload	2026-09-12	50%
sha256_hash	`9d87e6615c810907443ebd5e915f3b35099c3b5c6b6c684637138a7f8ec9cebc`	payload	2026-09-12	50%
sha256_hash	`cc76bc218627279ecb4d0ce74ad2651e9db9e3e843e35d6569576e056e3a9218`	payload	2026-09-12	50%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Mirai
let malicious_hashes = dynamic(["13382c16e2401b07451577b46e634b8031ec254d98b876e59692b5fa22abc1d4", "6fbae3505ae0d638b820165c572d548ce92dda71e82dc47e8efe13f30617f35f", "9d7cd4948a1fcbaeadc425752fce9a933bd6fc41eeede030dffd7b99b3bc51d5", "9d87e6615c810907443ebd5e915f3b35099c3b5c6b6c684637138a7f8ec9cebc", "cc76bc218627279ecb4d0ce74ad2651e9db9e3e843e35d6569576e056e3a9218"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Mirai

False Positive Guidance

Legitimate Network Scanning by Security Teams: Security engineers or automated vulnerability scanners (e.g., Nessus, Qualys, or custom Python scripts) often probe common Mirai target ports (1883, 514, 1900, 323, 10001) to identify exposed IoT devices or vulnerable services.
- Filter/Exclusion: Exclude source IPs belonging to the dedicated Security Scanning VLAN or specific service accounts (e.g., svc-nessus, sec-scan) when the destination port matches one of the 5 Mirai IOCs.
IoT Device Firmware Update or Configuration Polling: Enterprise IoT devices (e.g., IP cameras, smart thermostats, industrial PLCs) may legitimately communicate with internal update servers or configuration management platforms on ports like 1883 (MQTT) or 1900 (UPnP) as part of scheduled maintenance windows.
- Filter/Exclusion: Exclude traffic where the destination IP is a known internal IoT Management Server (e.g., 10.20.5.10) and the source IP falls within the IoT device subnet range (e.g., 192.168.50.0/24).
Scheduled Health Checks by Monitoring Agents: Monitoring tools like Zabbix, Nagios, or Datadog agents may perform active checks against IoT endpoints using specific ports (e.g., 10001 for some legacy protocols or 514 for syslog forwarding) to verify service availability.
- Filter/Exclusion: Exclude connections where the source process is a known monitoring agent (e.g., zabbix_agent2.exe, nagios.exe, datadog-agent.exe) or where the source IP is a designated Monitoring Server.
**UPnP