The ThreatFox: Mirai IOCs rule detects potential compromise indicators linked to the Mirai botnet, which is commonly used to launch large-scale DDoS attacks. SOC teams should proactively hunt for these IOCs in Azure Sentinel to identify and mitigate early-stage Mirai-based threats before they can be leveraged for widespread network disruption.
IOC Summary
Malware Family: Mirai Total IOCs: 14 IOC Types: url, ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| url | hxxp://45[.]205[.]1[.]59/ok | payload_delivery | 2026-06-06 | 80% |
| ip:port | 45[.]205[.]1[.]59:80 | payload_delivery | 2026-06-06 | 80% |
| ip:port | 188[.]54[.]47[.]14:2375 | payload_delivery | 2026-06-06 | 80% |
| ip:port | 172[.]104[.]241[.]98:2375 | payload_delivery | 2026-06-06 | 80% |
| ip:port | 180[.]189[.]174[.]146:80 | payload_delivery | 2026-06-06 | 80% |
| ip:port | 83[.]229[.]8[.]197:80 | payload_delivery | 2026-06-06 | 80% |
| ip:port | 150[.]241[.]98[.]49:80 | payload_delivery | 2026-06-06 | 80% |
| ip:port | 165[.]154[.]46[.]183:80 | payload_delivery | 2026-06-06 | 80% |
| ip:port | 185[.]177[.]125[.]71:2375 | payload_delivery | 2026-06-06 | 80% |
| ip:port | 143[.]198[.]199[.]73:2375 | payload_delivery | 2026-06-06 | 80% |
| ip:port | 34[.]173[.]83[.]139:2375 | payload_delivery | 2026-06-06 | 80% |
| ip:port | 94[.]124[.]119[.]36:2375 | payload_delivery | 2026-06-06 | 80% |
| ip:port | 167[.]71[.]47[.]6:80 | payload_delivery | 2026-06-06 | 80% |
| url | hxxp://45[.]198[.]224[.]5/ok | payload_delivery | 2026-06-06 | 80% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Mirai
let malicious_ips = dynamic(["172.104.241.98", "34.173.83.139", "45.205.1.59", "167.71.47.6", "188.54.47.14", "185.177.125.71", "165.154.46.183", "94.124.119.36", "83.229.8.197", "180.189.174.146", "143.198.199.73", "150.241.98.49"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["172.104.241.98", "34.173.83.139", "45.205.1.59", "167.71.47.6", "188.54.47.14", "185.177.125.71", "165.154.46.183", "94.124.119.36", "83.229.8.197", "180.189.174.146", "143.198.199.73", "150.241.98.49"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc// Hunt for access to known malicious URLs
// Source: ThreatFox - Mirai
let malicious_urls = dynamic(["http://45.205.1.59/ok", "http://45.198.224.5/ok"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
UrlClickEvents | Ensure this data connector is enabled |
Scenario: Scheduled System Backup Using tar
Description: A legitimate scheduled job runs tar to back up system files, which may include the string “tar” in the command line.
Filter/Exclusion: process.name != "tar" or process.args !~ "tar"
Scenario: Admin Task Using nc for Network Diagnostics
Description: An administrator uses nc (Netcat) to test network connectivity or port availability, which is a common diagnostic tool.
Filter/Exclusion: process.name != "nc" or process.args !~ "nc"
Scenario: Logrotate Job Using gzip
Description: The logrotate utility compresses log files using gzip, which may trigger the rule due to the presence of “gzip” in the command line.
Filter/Exclusion: process.name != "gzip" or process.args !~ "gzip"
Scenario: Cron Job for System Monitoring with iftop
Description: A cron job runs iftop to monitor network traffic, which is a legitimate system monitoring tool.
Filter/Exclusion: process.name != "iftop" or process.args !~ "iftop"
Scenario: Docker Container Management Using docker CLI
Description: System administrators use the docker CLI to manage containers, which may include commands that match Mirai-related IOCs.
Filter/Exclusion: process.name != "docker" or process.args !~ "docker"