This hypothesis targets the presence of known Mirai botnet indicators, which adversaries use to establish compromised hosts for large-scale DDoS attacks and lateral movement. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify and isolate infected endpoints before the botnet can propagate or execute its payload, reducing the risk of significant network disruption.
Malware Family: Mirai Total IOCs: 27 IOC Types: ip:port, sha256_hash
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 176[.]65[.]139[.]206:3778 | botnet_cc | 2026-09-21 | 80% |
| sha256_hash | 82d16a631297bdfde2b55177d15ca38c742ca677369e92ae4000c4c93350dffb | payload | 2026-09-21 | 100% |
| sha256_hash | 89ab7c1ae6dc1958d16133f4fd95caa9bcdbfbbdf785fdff7b79f45595d11522 | payload | 2026-09-21 | 100% |
| sha256_hash | 2ab69a4ccb50354c271b887c951c7628ec8183c478462dd816acffa316e21313 | payload | 2026-09-21 | 100% |
| sha256_hash | 4e278ef31f83894d66424e155d10b698be8806bc8a5d92e6688e65f34c870b26 | payload | 2026-09-21 | 100% |
| sha256_hash | e792ab78675a7d11daad2bed3b1cbca2eff9c32390d0a9f64d989c36b5d96476 | payload | 2026-09-21 | 100% |
| sha256_hash | 09710f936607bd3d1a1bc98f2117da196c55f6aed502f956eb0d915e960dacd5 | payload | 2026-09-21 | 100% |
| sha256_hash | 3d219efe6dd1214c4b087b501ec98c2f476c51c07f93a1ebc430f497c9885c16 | payload | 2026-09-21 | 100% |
| sha256_hash | 15531624bc94fe22d9197148447c48d907a75a2c2d2974cca953d4143e99ff62 | payload | 2026-09-21 | 100% |
| sha256_hash | b1f1b197882e2b6547bd2bea358bf949a12724fb024bbe8899e912e066ce2e16 | payload | 2026-09-21 | 100% |
| sha256_hash | d1c8c16dbf50b833a39469cbc48227605689c570af871b4be25a80fb08e3ba72 | payload | 2026-09-21 | 100% |
| sha256_hash | 4e9898bbc47a12fefe7cb4840f73da779b9958799f3496fc9ce8d6a69240305f | payload | 2026-09-21 | 100% |
| sha256_hash | 7a9a1e1b81067fd714d273f8826d57375dfcbf4300d1a3927ce3364e93f53633 | payload | 2026-09-21 | 100% |
| sha256_hash | dbf8a577d037022a5c8834874be21590b399b0dc5e5103241b3d34d723d05186 | payload | 2026-09-21 | 100% |
| sha256_hash | c4e9529b30411b3d47fcb4cedd0416f74581c40d3f1bd7f01e8f00abb2344392 | payload | 2026-09-21 | 100% |
| sha256_hash | d03c0e897d5aef598330056653174ccb4d9213e006fa761f1330cebb209f050a | payload | 2026-09-21 | 100% |
| sha256_hash | 9c65254164709d57c329416517f0b68fc10a125bcd472421fb099acf158b9539 | payload | 2026-09-21 | 100% |
| sha256_hash | d291584f990425964b057e62a4eeba5b383153959ac8257e7a66a5cadc077f64 | payload | 2026-09-21 | 100% |
| sha256_hash | 2b08a2d856b1611e827bb9adc3bec0c46757d362494068eafe0bd1c6c8398019 | payload | 2026-09-21 | 100% |
| sha256_hash | 4a728d67e157fc010c7eb1b4d0de0815163d63183f0a083f6fe6485b5d747039 | payload | 2026-09-21 | 100% |
| sha256_hash | a1388b624bb5dde9d26dfe68b4c2d4d9741861a13c4f6d4e85c48b9283c52b80 | payload | 2026-09-21 | 100% |
| sha256_hash | 53ed214fd5f899b5d3e54e41b22dab4340dae96a241e7032504515a5cc65cd48 | payload | 2026-09-21 | 100% |
| sha256_hash | 958d673e4aa911702d7a539d65e444b977d7c519a3f7d18b508c6a0bb4d1f2f0 | payload | 2026-09-21 | 100% |
| sha256_hash | 83fb8edc16b1c955fd226dd3b1a649b6a96250ac5802ace060bfcdc233fff617 | payload | 2026-09-21 | 100% |
| sha256_hash | de5e52a010cb1a88b64c410dda44d56d03cfed8aded705cbb3b305ee7b9245a8 | payload | 2026-09-21 | 100% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Mirai
let malicious_ips = dynamic(["176.65.139.206"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["176.65.139.206"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc// Hunt for files matching known malicious hashes
// Source: ThreatFox - Mirai
let malicious_hashes = dynamic(["82d16a631297bdfde2b55177d15ca38c742ca677369e92ae4000c4c93350dffb", "89ab7c1ae6dc1958d16133f4fd95caa9bcdbfbbdf785fdff7b79f45595d11522", "2ab69a4ccb50354c271b887c951c7628ec8183c478462dd816acffa316e21313", "4e278ef31f83894d66424e155d10b698be8806bc8a5d92e6688e65f34c870b26", "e792ab78675a7d11daad2bed3b1cbca2eff9c32390d0a9f64d989c36b5d96476", "09710f936607bd3d1a1bc98f2117da196c55f6aed502f956eb0d915e960dacd5", "3d219efe6dd1214c4b087b501ec98c2f476c51c07f93a1ebc430f497c9885c16", "15531624bc94fe22d9197148447c48d907a75a2c2d2974cca953d4143e99ff62", "b1f1b197882e2b6547bd2bea358bf949a12724fb024bbe8899e912e066ce2e16", "d1c8c16dbf50b833a39469cbc48227605689c570af871b4be25a80fb08e3ba72", "4e9898bbc47a12fefe7cb4840f73da779b9958799f3496fc9ce8d6a69240305f", "7a9a1e1b81067fd714d273f8826d57375dfcbf4300d1a3927ce3364e93f53633", "dbf8a577d037022a5c8834874be21590b399b0dc5e5103241b3d34d723d05186", "c4e9529b30411b3d47fcb4cedd0416f74581c40d3f1bd7f01e8f00abb2344392", "d03c0e897d5aef598330056653174ccb4d9213e006fa761f1330cebb209f050a", "9c65254164709d57c329416517f0b68fc10a125bcd472421fb099acf158b9539", "d291584f990425964b057e62a4eeba5b383153959ac8257e7a66a5cadc077f64", "2b08a2d856b1611e827bb9adc3bec0c46757d362494068eafe0bd1c6c8398019", "4a728d67e157fc010c7eb1b4d0de0815163d63183f0a083f6fe6485b5d747039", "a1388b624bb5dde9d26dfe68b4c2d4d9741861a13c4f6d4e85c48b9283c52b80", "53ed214fd5f899b5d3e54e41b22dab4340dae96a241e7032504515a5cc65cd48", "958d673e4aa911702d7a539d65e444b977d7c519a3f7d18b508c6a0bb4d1f2f0", "83fb8edc16b1c955fd226dd3b1a649b6a96250ac5802ace060bfcdc233fff617", "de5e52a010cb1a88b64c410dda44d56d03cfed8aded705cbb3b305ee7b9245a8", "7de772085a6413e69e1fbc18612bebf5dd8d7cdafbedf41b631e495097450830", "c2c6af0ad42ba49749146c98fbecaae17d26329d91d1cdfcfaa8ee4890377f26"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceFileEvents | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Scenario: A DevOps team deploys a containerized microservice using a base image derived from an older Alpine or BusyBox variant that includes the telnet client binary. The Mirai IOC list often flags specific telnet binary hashes or paths (e.g., /usr/bin/telnet) that match the standard system utility, triggering alerts on every container startup.
/usr/bin/telnet or /bin/telnet AND the parent process is a container runtime (e.g., dockerd, containerd-shim, crio) or a standard init system (e.g., tini, dumb-init).Scenario: An IT administrator performs a routine network diagnostic on a Linux server using the netstat or ss command to check established connections. If the Mirai IOC set includes generic TCP port checks (e.g., listening on port 23, 2323, or 2324) or specific command-line arguments like netstat -an | grep 23, legitimate administrative troubleshooting will trigger the rule.
netstat or ss AND the user is a known service account (e.g., root, admin, svc-network) AND the process duration is less than 10 seconds.Scenario: A CI/CD pipeline runs a static analysis or vulnerability scanning tool (such as trivy, grype, or snyk) that scans container images or host filesystems. These tools often read binary files to calculate hashes or inspect strings, which can match the file hashes or string patterns (e.g., “Mirai”, “botnet”) included in the ThreatFox IOC list.