ThreatFox: Mirai IOCs

Hunt Hypothesis

This hypothesis posits that adversaries are leveraging known Mirai botnet indicators to establish initial footholds or expand command-and-control infrastructure within the network perimeter. Proactive hunting in Azure Sentinel is critical because early detection of these specific IOCs enables the SOC team to isolate compromised assets before they can propagate lateral movement or launch large-scale DDoS attacks against internal resources.

IOC Summary

Malware Family: Mirai Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Mirai
let malicious_ips = dynamic(["91.92.42.50", "103.130.215.73"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["91.92.42.50", "103.130.215.73"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Mirai

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: Mirai IOCs detection rule in an enterprise environment, along with suggested filters and exclusions:

• Network Scanning Infrastructure Activity

  • Scenario: Enterprise vulnerability scanners (e.g., Tenable Nessus, Qualys, or Nmap) periodically probe all assets to identify open ports and service versions. Since Mirai is known for scanning specific ports (like 23, 80, 443) across the internet, these internal scans often generate traffic patterns that match Mirai IOCs, particularly when scanning IoT devices or legacy servers within the DMZ.
  • Filter/Exclusion: Create a whitelist rule excluding source IPs belonging to the Vulnerability Management subnet (e.g., 10.20.50.0/24) and destination ports associated with standard scan traffic. Additionally, exclude traffic where the user-agent string contains “Tenable” or “Qualys”.

• Automated Firmware Update Jobs

  • Scenario: Scheduled maintenance jobs run by IT operations teams to push firmware updates to a fleet of IoT devices (such as IP cameras from Axis, Hikvision, or VoIP phones). These update servers often initiate outbound connections to vendor repositories that share the same IP ranges or ASN (Autonomous System Numbers) flagged in the ThreatFox Mirai package, mimicking the bot’s communication with command-and-control (C2) servers.
  • Filter/Exclusion: Exclude traffic originating from specific Scheduled Task Service Accounts (e.g., svc-firmware-updater) running on the patch management server (Microsoft SCCM or Ivanti). Filter by time-of-day constraints to only alert outside of standard maintenance windows (e.g., exclude 02:00–04:00 UTC) if