ThreatFox: Mirai IOCs

Hunt Hypothesis

This hypothesis posits that adversaries are actively scanning Azure workloads using known Mirai botnet indicators to identify vulnerable IoT devices and establish initial footholds. Proactive hunting is critical in Azure Sentinel to rapidly detect these specific IOCs before they trigger large-scale DDoS attacks or facilitate lateral movement across the cloud infrastructure.

IOC Summary

Malware Family: Mirai Total IOCs: 2 IOC Types: ip:port

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - Mirai
let malicious_ips = dynamic(["94.154.43.42", "94.154.43.12"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["94.154.43.42", "94.154.43.12"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — Mirai

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: Mirai IOCs detection rule in an enterprise environment, along with suggested filters and exclusions:

• Network Scanning by Vulnerability Management Tools

  • Scenario: Enterprise vulnerability scanners (e.g., Tenable Nessus, Qualys, or Rapid7 InsightVM) periodically probe the entire network to identify open ports and service versions. These tools often initiate outbound connections to well-known IP ranges that overlap with Mirai’s known command-and-control (C2) infrastructure or scan internal IoT devices, triggering hits on the rule’s IP or port-based IOCs.
  • Filter/Exclusion: Create an exclusion rule for source IPs belonging to the Vulnerability Management subnet and destination ports commonly used by scanners (e.g., TCP 80, 443, 161). Additionally, exclude traffic where the user agent string contains specific identifiers like Tenable or Qualys.

• Scheduled Firmware Updates for IoT Devices

  • Scenario: In environments with a high density of IoT devices (IP cameras, smart printers, HVAC controllers), scheduled maintenance windows trigger automatic firmware checks and updates. These devices often communicate directly with vendor update servers that share IP ranges or DNS patterns with Mirai IOCs. For example, a batch of Axis Communications cameras updating via Microsoft Azure endpoints might match the rule’s hash or network flow signatures.
  • Filter/Exclusion: Exclude traffic originating from specific IoT VLANs (e.g., VLAN-105-IoT) during defined maintenance windows (e.g., Sundays 02:00–04:00 UTC). Alternatively, filter out connections where the destination IP is part of a known “Trusted Vendor” allowlist that includes major IoT manufacturers.

• **Cloud Backup