This hunt detects the initial infection phase of Mirai malware, where compromised IoT devices communicate with known malicious URLs to establish command-and-control channels or download payloads for botnet recruitment. Proactively hunting for these URL interactions in Azure Sentinel is critical to identify early-stage compromises before they escalate into large-scale DDoS attacks that can overwhelm network infrastructure and disrupt business operations.
Threat: mirai Total URLs: 23 Active URLs: 23
| URL | Status | Threat | Date Added |
|---|---|---|---|
hxxp://210.208.111.100:60334/i | online | malware_download | 2026-08-25 |
hxxp://180.116.151.75:50936/i | online | malware_download | 2026-08-25 |
hxxp://183.23.136.185:35951/i | online | malware_download | 2026-08-25 |
hxxp://210.208.111.74:41375/bin.sh | online | malware_download | 2026-08-25 |
hxxp://210.208.110.172:38919/i | online | malware_download | 2026-08-25 |
hxxp://180.252.217.7:57217/i | online | malware_download | 2026-08-25 |
hxxp://123.185.64.34:36611/i | online | malware_download | 2026-08-25 |
hxxp://120.28.189.248:56580/i | online | malware_download | 2026-08-25 |
hxxp://222.127.53.189:51312/bin.sh | online | malware_download | 2026-08-25 |
hxxp://115.50.238.131:51347/i | online | malware_download | 2026-08-25 |
hxxp://115.58.181.133:33235/bin.sh | online | malware_download | 2026-08-25 |
hxxp://119.179.30.73:48215/i | online | malware_download | 2026-08-25 |
hxxp://36.69.73.14:48649/i | online | malware_download | 2026-08-25 |
hxxp://115.50.238.131:51347/bin.sh | online | malware_download | 2026-08-25 |
hxxp://115.206.176.178:48491/i | online | malware_download | 2026-08-25 |
hxxp://210.208.110.20:51160/i | online | malware_download | 2026-08-25 |
hxxp://105.186.99.161:34643/i | online | malware_download | 2026-08-25 |
hxxp://113.221.47.252:58353/bin.sh | online | malware_download | 2026-08-25 |
hxxp://210.208.111.220:49419/i | online | malware_download | 2026-08-25 |
hxxp://36.69.73.14:48649/bin.sh | online | malware_download | 2026-08-25 |
hxxp://36.251.0.100:33623/i | online | malware_download | 2026-08-25 |
hxxp://222.127.53.189:51312/i | online | malware_download | 2026-08-25 |
hxxp://210.208.111.74:41375/i | online | malware_download | 2026-08-25 |
// Hunt for DNS resolution of URLhaus malicious domains
// Threat: mirai
let malicious_domains = dynamic(["119.179.30.73", "210.208.110.172", "123.185.64.34", "113.221.47.252", "180.116.151.75", "115.50.238.131", "36.251.0.100", "183.23.136.185", "222.127.53.189", "36.69.73.14", "210.208.111.74", "115.58.181.133", "105.186.99.161", "115.206.176.178", "120.28.189.248", "180.252.217.7", "210.208.110.20", "210.208.111.100", "210.208.111.220"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc
// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["119.179.30.73", "210.208.110.172", "123.185.64.34", "113.221.47.252", "180.116.151.75", "115.50.238.131", "36.251.0.100", "183.23.136.185", "222.127.53.189", "36.69.73.14", "210.208.111.74", "115.58.181.133", "105.186.99.161", "115.206.176.178", "120.28.189.248", "180.252.217.7", "210.208.110.20", "210.208.111.100", "210.208.111.220"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc
| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
Scenario 1: Automated Firmware Update Checks by IoT Management Platforms
firmware.updates.net or specific cloud endpoints) to check for device firmware versions. These URLs often host large binary files and may be hosted on shared infrastructure that URLhaus flags as “Mirai-like” due to high traffic volume and specific file signatures resembling botnet command-and-control patterns.10.20.30.5) to known vendor update domains, regardless of URLhaus threat classification. Alternatively, whitelist specific hash values of known good firmware files if the detection is file-based.Scenario 2: Scheduled Backup Jobs for Network Attached Storage (NAS) and Surveillance Systems