ThreatFox: Mirai IOCs

Hunt Hypothesis

This hunt targets the presence of known Mirai botnet indicators of compromise, which often signify compromised IoT devices or servers being leveraged for distributed denial-of-service attacks. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify and isolate infected assets before they are fully integrated into the botnet, thereby reducing the risk of sudden network saturation and lateral movement.

IOC Summary

Malware Family: Mirai Total IOCs: 5 IOC Types: url

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - Mirai
let malicious_urls = dynamic(["http://34.92.225.25:8084/?h=34.92.225.25&p=8084&t=ws&a=l32&stage=true", "http://420mafia.eu/ar-15/ar15.arc", "http://420mafia.eu/ar-15/ar15.m68k", "http://193.160.32.138:8085/?h=193.160.32.138&p=8085&t=ws&a=l32&stage=true", "http://420mafia.eu/ar-15/ar15.x86_64"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Mirai

False Positive Guidance

• Automated Firmware Update Scripts: Many IoT devices and network appliances (e.g., Ubiquiti UniFi, Cisco IOS) use wget or curl to fetch firmware images from vendor CDNs. If the Mirai IOCs include specific hash values or URL patterns that overlap with common firmware distribution endpoints or generic binary names, these routine updates may trigger alerts.

  • Filter/Exclusion: Exclude processes where the parent process is a known package manager or update service (e.g., apt, yum, dnf, unifi-controller) and the destination path is within standard firmware directories (e.g., /opt/ubnt/, /var/lib/firmware/).

• CI/CD Pipeline Artifact Downloads: In DevOps environments, build agents (e.g., Jenkins, GitLab Runner, Azure DevOps) frequently download binary artifacts, container images, or dependency libraries from internal artifact repositories (e.g., Nexus, Artifactory, AWS S3). If the Mirai IOCs include generic SHA256 hashes or file names that match common build tools or libraries, these legitimate downloads will be flagged.

  • Filter/Exclusion: Exclude events where the source IP is within the internal CI/CD subnet range or where the parent process is a known build agent binary (e.g., java, node, python executing a build script) and the file is located in a workspace directory (e.g., /home/jenkins/workspace/, /tmp/build/).

• Container Image Layer Extraction: When Kubernetes or Docker pulls and extracts container images, it unpacks tarballs containing binaries and libraries. If the Mirai IOCs include hashes for common system libraries (like libc, openssl, or zlib) that are also present in the Mirai botnet’s payload, the extraction process on the node will trigger the detection.

  • *