ThreatFox: Mirai IOCs | SOC Hunt Feed

Hunt Hypothesis

This detection rule identifies network traffic matching known Indicators of Compromise (IOCs) from the Mirai botnet, which adversaries exploit to establish command-and-control channels and launch large-scale DDoS attacks. Proactively hunting for these signatures in Azure Sentinel is critical to rapidly isolate infected IoT devices before they compromise internal network integrity or initiate widespread infrastructure disruption.

IOC Summary

Malware Family: Mirai Total IOCs: 2 IOC Types: url

Type	Value	Threat Type	First Seen	Confidence
url	`hxxp://8[.]213[.]214[.]55/nerv.mips`	payload_delivery	2026-07-23	75%
url	`hxxp://110[.]37[.]76[.]236:59516/Mozi.m`	payload_delivery	2026-07-23	75%

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Mirai
let malicious_urls = dynamic(["http://8.213.214.55/nerv.mips", "http://110.37.76.236:59516/Mozi.m"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`UrlClickEvents`	Ensure this data connector is enabled

References

ThreatFox — Mirai

False Positive Guidance

Here are specific false positive scenarios and corresponding filters/exclusions for the ThreatFox: Mirai IOCs detection rule in an enterprise environment:

IoT Device Firmware Updates via Scheduled Tasks
- Scenario: Enterprise-managed IoT devices (e.g., smart thermostats, IP cameras, or industrial sensors) running on Windows-based gateways often perform nightly firmware updates. These tasks may initiate outbound connections to vendor update servers that share the same IP ranges or hash signatures as Mirai-infected botnets.
- Filter/Exclusion: Create an exclusion rule for specific scheduled task names (e.g., UpdateService.exe running under SYSTEM) and whitelist the known vendor update server IP ranges (e.g., 192.0.2.50-60). Additionally, exclude traffic originating from the “IoT Management VLAN” subnet during maintenance windows (e.g., 02:00–04:00 UTC).
External Backup and Cloud Sync Operations
- Scenario: Automated backup agents such as Veeam, Rubrik, or Microsoft Azure Backup frequently establish connections to external cloud storage endpoints. If the Mirai IOC list includes generic public IP ranges used by major cloud providers, these legitimate high-volume data transfers can trigger alerts due to matching port usage (e.g., TCP 80/443) and connection patterns similar to Mirai’s propagation behavior.
- Filter/Exclusion: Implement a filter that excludes traffic where the destination IP belongs to known public cloud CIDR blocks (e.g., AWS, Azure, Google Cloud ranges). Furthermore, exclude processes with specific executable hashes for backup agents (e.g., Veeam.Backup.Service.exe) when communicating on standard HTTPS ports.
Network Scanning and Vulnerability Assessment Tools
- Scenario: Security teams routinely