This hunt detects adversary activity where compromised devices establish connections to known RaspberryPiBotnet infrastructure, indicating potential botnet recruitment or command-and-control communication. Proactively hunting for these 55 specific IOCs in Azure Sentinel is critical to identify early-stage infections and prevent the scaling of a distributed denial-of-service (DDoS) attack orchestrated by this IoT-focused botnet.
Malware Family: RaspberryPiBotnet Total IOCs: 55 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 91[.]92[.]47[.]220:8081 | botnet_cc | 2026-08-25 | 100% |
| ip:port | 110[.]76[.]145[.]222:8081 | botnet_cc | 2026-08-25 | 100% |
| ip:port | 185[.]212[.]129[.]2:8081 | botnet_cc | 2026-08-25 | 100% |
| ip:port | 38[.]45[.]65[.]144:8081 | botnet_cc | 2026-08-25 | 100% |
| ip:port | 37[.]152[.]188[.]110:8081 | botnet_cc | 2026-08-25 | 100% |
| ip:port | 171[.]244[.]199[.]198:8081 | botnet_cc | 2026-08-25 | 100% |
| ip:port | 36[.]37[.]122[.]175:8081 | botnet_cc | 2026-08-25 | 100% |
| ip:port | 43[.]108[.]83[.]139:8081 | botnet_cc | 2026-08-25 | 100% |
| ip:port | 5[.]42[.]125[.]156:8081 | botnet_cc | 2026-08-25 | 100% |
| ip:port | 169[.]58[.]219[.]255:8081 | botnet_cc | 2026-08-25 | 100% |
| ip:port | 158[.]69[.]210[.]7:8081 | botnet_cc | 2026-08-25 | 100% |
| ip:port | 185[.]164[.]72[.]145:8081 | botnet_cc | 2026-08-25 | 100% |
| ip:port | 217[.]219[.]165[.]57:8081 | botnet_cc | 2026-08-25 | 100% |
| ip:port | 185[.]121[.]13[.]242:8081 | botnet_cc | 2026-08-25 | 100% |
| ip:port | 188[.]92[.]182[.]10:8081 | botnet_cc | 2026-08-25 | 100% |
| ip:port | 51[.]255[.]28[.]210:8081 | botnet_cc | 2026-08-25 | 100% |
| ip:port | 37[.]97[.]131[.]30:8081 | botnet_cc | 2026-08-25 | 100% |
| ip:port | 103[.]253[.]244[.]145:8081 | botnet_cc | 2026-08-25 | 100% |
| ip:port | 130[.]185[.]123[.]230:8081 | botnet_cc | 2026-08-25 | 100% |
| ip:port | 176[.]65[.]58[.]214:8081 | botnet_cc | 2026-08-25 | 100% |
| ip:port | 88[.]99[.]73[.]187:8081 | botnet_cc | 2026-08-25 | 100% |
| ip:port | 193[.]233[.]18[.]68:8081 | botnet_cc | 2026-08-25 | 100% |
| ip:port | 194[.]87[.]251[.]137:8081 | botnet_cc | 2026-08-25 | 100% |
| ip:port | 161[.]248[.]123[.]78:8081 | botnet_cc | 2026-08-25 | 100% |
| ip:port | 110[.]76[.]145[.]218:8081 | botnet_cc | 2026-08-25 | 100% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - RaspberryPiBotnet
let malicious_ips = dynamic(["176.118.193.229", "185.212.129.2", "154.86.30.133", "193.42.115.137", "36.133.84.116", "185.164.72.145", "88.99.73.187", "193.168.147.81", "169.58.176.232", "46.4.162.51", "217.219.165.57", "5.42.125.156", "37.97.131.30", "193.233.18.68", "91.92.47.220", "194.87.251.137", "37.152.188.110", "43.224.226.119", "138.2.105.161", "2.27.193.132", "188.92.182.10", "188.40.198.241", "103.117.137.106", "95.164.90.16", "153.80.241.71", "194.59.171.247", "103.253.244.145", "158.69.210.7", "43.108.83.139", "109.205.58.43", "185.121.13.242", "38.45.65.144", "176.65.58.214", "110.76.145.218", "36.37.122.175", "151.242.187.122", "169.58.219.255", "51.75.182.116", "185.81.99.73", "169.58.182.5", "51.255.28.210", "8.209.69.149", "110.76.145.222", "5.35.78.169", "45.147.97.142", "130.185.123.230", "171.244.199.198", "194.163.135.199", "177.201.224.10", "194.35.227.68"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc
// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["176.118.193.229", "185.212.129.2", "154.86.30.133", "193.42.115.137", "36.133.84.116", "185.164.72.145", "88.99.73.187", "193.168.147.81", "169.58.176.232", "46.4.162.51", "217.219.165.57", "5.42.125.156", "37.97.131.30", "193.233.18.68", "91.92.47.220", "194.87.251.137", "37.152.188.110", "43.224.226.119", "138.2.105.161", "2.27.193.132", "188.92.182.10", "188.40.198.241", "103.117.137.106", "95.164.90.16", "153.80.241.71", "194.59.171.247", "103.253.244.145", "158.69.210.7", "43.108.83.139", "109.205.58.43", "185.121.13.242", "38.45.65.144", "176.65.58.214", "110.76.145.218", "36.37.122.175", "151.242.187.122", "169.58.219.255", "51.75.182.116", "185.81.99.73", "169.58.182.5", "51.255.28.210", "8.209.69.149", "110.76.145.222", "5.35.78.169", "45.147.97.142", "130.185.123.230", "171.244.199.198", "194.163.135.199", "177.201.224.10", "194.35.227.68"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc
| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Here are specific false positive scenarios and corresponding filters for the ThreatFox: RaspberryPiBotnet IOCs detection rule in an enterprise environment:
IoT Device Management & Firmware Updates
VLAN-40-IoT) and whitelist known update domains such as updates.raspberrypi.org or specific IP ranges assigned to the device management server.Internal DevOps & CI/CD Pipeline Execution
github.com, pypi.org) which may overlap with the botnet’s known benign infrastructure IPs.svc-jenkins-build or gitlab-runner).Scheduled Network Scanning & Asset Discovery