This hunt identifies network traffic or host activity matching known indicators of compromise for the Mirai botnet, a prevalent threat that often leverages IoT devices to launch large-scale DDoS attacks. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to detect compromised assets early, preventing them from being recruited into the botnet and minimizing the risk of widespread network disruption or lateral movement.
Malware Family: Mirai Total IOCs: 2 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 94[.]154[.]43[.]211:80 | botnet_cc | 2026-09-18 | 75% |
| ip:port | 176[.]65[.]132[.]207:80 | botnet_cc | 2026-09-18 | 75% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Mirai
let malicious_ips = dynamic(["176.65.132.207", "94.154.43.211"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["176.65.132.207", "94.154.43.211"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Scenario: A network operations engineer runs a scripted vulnerability scan using nmap or masscan against internal IoT devices (e.g., IP cameras, smart thermostats) to verify firmware versions, triggering the Mirai IOCs related to common open ports (like 23/2323) or specific user-agent strings if the tool mimics standard HTTP requests.
NetOps-Scanners security group or specific management VLANs (e.g., 10.20.0.0/24) from the IOC match, particularly if the destination is a known IoT asset registry.Scenario: A DevOps team deploys a new batch of Raspberry Pi-based edge nodes for a smart building project, and the initialization script performs a standard curl request to a local configuration server or NTP sync service, which may match the Mirai IOCs if the user-agent string or specific port combination (e.g., 2323 for Telnet) overlaps with the threat intelligence feed.
Environment=Edge-Dev or AppGroup=IoT-Init that are in their first 24 hours of uptime, or exclude traffic where the source is in the Dev-Edge subnet and the destination is the internal Config-Server IP.Scenario: A legacy industrial control system (ICS) gateway uses a proprietary protocol that happens to share a port number or user-agent string with the Mirai IOCs (e.g., using port 23 for Telnet management), and an administrator performs routine maintenance via a jump host, generating traffic that matches the IOC.
Jump-Hosts list and