ThreatFox: Mirai IOCs

Hunt Hypothesis

This detection rule identifies network traffic matching six specific Indicators of Compromise (IOCs) linked to the Mirai botnet, which is known for executing large-scale DDoS attacks and IoT device compromises. SOC teams should proactively hunt for these signatures in Azure Sentinel to rapidly isolate infected endpoints and prevent potential lateral movement or service disruption before the botnet scales its attack capabilities.

IOC Summary

Malware Family: Mirai Total IOCs: 6 IOC Types: ip:port, domain

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Mirai
let malicious_ips = dynamic(["79.143.191.7", "94.154.43.87", "91.92.40.5", "94.154.43.175"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["79.143.191.7", "94.154.43.87", "91.92.40.5", "94.154.43.175"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - Mirai
let malicious_domains = dynamic(["mail.coping.ink", "smtp.coping.ink"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

References

• ThreatFox — Mirai

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: Mirai IOCs detection rule, along with targeted exclusion strategies suitable for an enterprise environment:

• Scenario 1: IoT Device Firmware Updates via Scheduled Tasks

  • Context: Enterprise-managed smart devices (e.g., IP cameras from Axis or Hikvision, smart thermostats) often perform automatic firmware checks and updates. These devices frequently connect to vendor update servers that share the same public IP ranges identified as Mirai IOCs in the ThreatFox feed. The detection triggers because the device initiates an outbound connection to a known Mirai-associated IP during its nightly maintenance window.
  • Filter/Exclusion: Create a whitelist exclusion based on Source Host Group and Time Window. Exclude alerts where the source host belongs to the “IoT-Devices” Active Directory group or specific VLAN (e.g., VLAN-IoT) AND the event occurs between 02:00 and 04:00 UTC.

• Scenario 2: External Vendor API Integration for Asset Management

  • Context: The organization utilizes a third-party asset management tool (e.g., ServiceNow or Jira) that integrates with a cloud-based hardware inventory service hosted on an IP address currently flagged as a Mirai IOC. This integration runs continuously to sync device status, generating steady traffic to the IOC IP that mimics the command-and-control behavior of infected Mirai devices.
  • Filter/Exclusion: Implement a rule exclusion based on Destination URL and Process Name. Exclude alerts where the destination matches the specific vendor API endpoint (e.g., api.inventory-cloud.com) AND the initiating process is a known enterprise service, such as sn_agent.exe or jira-cli.jar.

• Scenario 3: Security Tool Telemetry and Threat Intelligence Feeds

  ---