ThreatFox: Mirai IOCs

Hunt Hypothesis

This hunt targets the presence of known Mirai botnet indicators of compromise, which typically signify an active IoT or server compromise used for large-scale DDoS attacks or lateral movement. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify and isolate infected assets before they are leveraged to amplify traffic or establish persistent footholds within the network.

IOC Summary

Malware Family: Mirai Total IOCs: 12 IOC Types: ip:port, sha256_hash, url

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Mirai
let malicious_ips = dynamic(["81.227.54.149", "222.141.122.254", "94.154.43.12", "113.228.85.214", "113.17.176.184"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["81.227.54.149", "222.141.122.254", "94.154.43.12", "113.228.85.214", "113.17.176.184"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Mirai
let malicious_urls = dynamic(["http://176.65.139.131/bins/mips"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Mirai
let malicious_hashes = dynamic(["6eee92142627b47cadb3a4833b18fa1f850079a4e643db0ef2a462fb2cdbc6f6", "18adfa234f839da6dfe8498c5ee850a5a2110c0c600746c96a0e152c81d0e19b", "cb4f23546d6a357f4950b07c9783a26a43bb3b4bede2bdce635d59e7e34bac80", "29eb6e30d78b3af2acefdf69632b5ce754e9cbab7c79873449f20c7945ad82a6", "c7e7d77602c121ebe2785d8e4068b7d459abe975ad9e3e8471ba28e9783b8dca", "45f31662334cc30b490ceb4abb90193980274a28204bcc862d1cdfe01326ba23"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Mirai

False Positive Guidance

• Scenario: A DevOps team deploys a custom network monitoring agent that uses the specific mirai binary name or hash for compatibility testing against legacy IoT devices in a lab environment.
  • Filter/Exclusion: Exclude events where the source path matches C:\Program Files\IoT-Lab\mirai\ or the process name is mirai_test.exe and the parent process is powershell.exe or cmd.exe initiated by a service account.
• Scenario: An automated backup job for a virtualization cluster uses a snapshot tool that temporarily creates a file named mirai.vmx or mirai.snap in the shared storage directory during the snapshot process.
  • Filter/Exclusion: Exclude file creation events where the file extension is .vmx or .snap and the directory path contains \VMware\ or \HyperV\ and the user account belongs to the BackupAdmins group.
• Scenario: A security team runs a YARA rule scan or memory dump analysis on a suspected host, and the analysis tool (e.g., volatility3 or yara.exe) creates temporary files or logs with the string “mirai” in the filename or content during the scan.
  • Filter/Exclusion: Exclude events where the parent process is yara.exe, volatility3.exe, or mimikatz.exe and the file path is located in C:\Temp\ or C:\Tools\ and the user account is a member of the SOCAnalysts group.
• Scenario: A CI/CD pipeline builds a Docker image for a legacy application that includes a static binary named mirai as a dependency for a specific protocol handler, and the build agent extracts it to the workspace directory.
  • **Filter/Ex