This hunt hypothesis detects adversaries leveraging Mirai malware to compromise IoT devices through default credentials and weak configurations, ultimately recruiting them as botnet nodes for distributed denial-of-service (DDoS) campaigns. A SOC team should proactively hunt for these indicators in Azure Sentinel to identify early-stage infections within the network perimeter before they scale into large-scale attacks that disrupt critical services.
Malware Family: Mirai Total IOCs: 6 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 147[.]90[.]250[.]35:9155 | botnet_cc | 2026-07-22 | 75% |
| ip:port | 5[.]231[.]70[.]61:3389 | botnet_cc | 2026-07-22 | 75% |
| ip:port | 94[.]154[.]43[.]102:25565 | botnet_cc | 2026-07-22 | 75% |
| ip:port | 5[.]231[.]70[.]61:4621 | botnet_cc | 2026-07-22 | 75% |
| ip:port | 129[.]121[.]114[.]124:5362 | botnet_cc | 2026-07-22 | 75% |
| ip:port | 129[.]121[.]114[.]124:25565 | botnet_cc | 2026-07-22 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Mirai
let malicious_ips = dynamic(["147.90.250.35", "5.231.70.61", "94.154.43.102", "129.121.114.124"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["147.90.250.35", "5.231.70.61", "94.154.43.102", "129.121.114.124"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Here are 4 specific false positive scenarios for the ThreatFox: Mirai IOCs detection rule, including suggested filters and exclusions tailored for an enterprise environment:
Scenario: Automated Firmware Update Scans by Network Management Tools
10.20.50.x for SolarWinds) and restrict alerts to connections where the destination port is not 80 or 443, as Mirai typically targets specific IoT ports like 23 (Telnet), 22 (SSH), or 80/8080 with specific user-agent strings.Scenario: Scheduled Backup Jobs for Legacy IoT Devices