This hypothesis targets the presence of known Mirai botnet indicators, which adversaries use to establish compromised IoT or Linux devices for large-scale DDoS attacks and lateral movement. Proactively hunting for these IOCs in Azure Sentinel is critical to identify and isolate infected assets before they are leveraged to amplify traffic or execute further malicious commands within the network.
Malware Family: Mirai Total IOCs: 4 IOC Types: sha256_hash
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| sha256_hash | 3db29da487bfe83452a4f875bddbd6a4f0a196a088d2247d2ba36e3f1d75b86b | payload | 2026-09-27 | 95% |
| sha256_hash | a97cea864850a09706d2fce9fcf3dbb4118f586ee5a6df1141130d750927019f | payload | 2026-09-27 | 95% |
| sha256_hash | b02966b9e8ff5a039babcc1192642ae6ef1d160e76a92420265815abd9b324c5 | payload | 2026-09-27 | 95% |
| sha256_hash | ab163943a962cb6bb8b55808a0d1d45863a36b65ebddf32b330b42600d8b77be | payload | 2026-09-27 | 100% |
// Hunt for files matching known malicious hashes
// Source: ThreatFox - Mirai
let malicious_hashes = dynamic(["3db29da487bfe83452a4f875bddbd6a4f0a196a088d2247d2ba36e3f1d75b86b", "a97cea864850a09706d2fce9fcf3dbb4118f586ee5a6df1141130d750927019f", "b02966b9e8ff5a039babcc1192642ae6ef1d160e76a92420265815abd9b324c5", "ab163943a962cb6bb8b55808a0d1d45863a36b65ebddf32b330b42600d8b77be"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
DeviceFileEvents | Ensure this data connector is enabled |
Scenario: A network operations center (NOC) engineer uses nmap or masscan to perform routine vulnerability scanning or asset discovery against internal IP ranges, specifically targeting the default Mirai ports (e.g., 23, 514, 6667, 10001) to identify unpatched IoT devices or legacy servers.
NOC-Scanners AD security group or specific management VLAN subnets (e.g., 10.20.0.0/24) when the destination port matches the Mirai IOC list and the connection state is SYN or SYN-ACK without established data transfer.Scenario: A DevOps team deploys a new batch of IoT gateways or smart sensors that are configured with default factory settings, including listening on port 23 (Telnet) or 6667 (IRC) for initial provisioning and configuration via standard tools like putty or telnet.
Environment=Staging or AssetClass=IoT-Gateway in CMDB if the connection originates from a known provisioning server (e.g., provisioning-server-01) and the destination host has been in the network for less than 48 hours.Scenario: A legacy application server running an older version of a monitoring agent (e.g., Nagios or Zabbix) opens a temporary debug port (e.g., 514 for Syslog or 10001 for custom health checks) during a scheduled maintenance window, which coincidentally matches a Mirai IOC port.