ThreatFox: Mirai IOCs

Hunt Hypothesis

This hunt targets known Indicators of Compromise (IOCs) associated with the Mirai botnet, which is frequently deployed to compromise IoT devices and servers for large-scale DDoS attacks. Proactively hunting for these IOCs in Azure Sentinel allows the SOC team to identify and isolate infected assets before they are leveraged to amplify traffic or establish persistent footholds within the network.

IOC Summary

Malware Family: Mirai Total IOCs: 13 IOC Types: sha256_hash

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Mirai
let malicious_hashes = dynamic(["494aec19883cb5454d5d8e84953ceed65b83af99ff8a9cbf049544105e2b5e18", "6c944e11383fe04397727893aeb668d8b7989bdf9510e5bc283dbfb9fccd6f05", "640e6ad1c159f02c2e940290113a3d48cf78f33e930217802f13eaa3b62cc384", "3b6786813f55f4f49a2ea1bac64413b94523bc4468ab02f403c6912cbb703377", "6c420372a15415c1544790df5fe5ce9c6ff0bbef65546c83e02110307e3a32ff", "41a7d7a61716cf707ca471609069bdf649ed687c1c29c52aa196aaef75f8d077", "ac534a13006b72805cc12ea91ff2e06ab843c3806eca0e21e81f163dbd5212c6", "c754338f9ebacd78d7582f28729705d4e61c0ef05f9b8e13a71a6a0f05438dab", "8738d60030156b9cd03f939bad1257e7cd34de4adda9c84841564995353df593", "f1617c27d3c3b58cb6f930e21b5ffb002915ab4f7424c77552be9f82180409a8", "939a999e03e1f80f3eb8e4e04b93c42339261e463e16582c2cccda1a28b57a8a", "d64ad56eca41d47cfb7f534623071dbdff25a49cdceae4dc9de6d7cdfa22e7ea", "54d08acac87f7b50b4aca64be345b520d03f00818b8288fbfa4034d1bffe5800"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Mirai

False Positive Guidance

• Scenario: A DevOps engineer uses curl or wget to download a specific firmware update or binary from a known vendor’s CDN that happens to share the same IP address or hash as one of the 13 Mirai IOCs (e.g., a public mirror for Linux kernel headers).
  • Filter/Exclusion: Exclude alerts where the source IP is within the corporate egress proxy range (e.g., 10.20.0.0/16) AND the user agent string contains curl/ or wget/ AND the destination port is 443.
• Scenario: An automated backup job (e.g., Veeam or Commvault) replicates data to an offsite storage node whose public IP matches a Mirai C2 beacon IP, particularly if the backup target is a cloud storage endpoint with a static public IP.
  • Filter/Exclusion: Exclude alerts where the process name is vsqlsvr.exe (Veeam) or commvault.exe AND the destination port is 443 or 8443 AND the source machine is tagged with the AD group Backup-Servers.
• Scenario: A security team performs a routine vulnerability scan using Nessus or Qualys, where the scanner’s public IP (or the IP of the scanning agent) matches a Mirai IOC due to shared hosting infrastructure or a reused IP block.
  • Filter/Exclusion: Exclude alerts where the source process is nessus.exe or qualysagent.exe AND the destination port is 443 AND the source machine is in the Security-Scanners AD group.
• Scenario: A CI/CD pipeline (e.g., Jenkins or GitLab Runner) pulls dependencies from a public GitHub or Docker Hub registry, where the registry’s edge IP matches a