This detection rule identifies network traffic accessing known Mirai botnet command-and-control URLs to uncover potential IoT device infections and lateral movement within the environment. Proactively hunting for these specific indicators in Azure Sentinel is critical because Mirai variants often exploit unpatched IoT devices as initial footholds, enabling adversaries to launch large-scale DDoS attacks or establish persistent backdoors before broader compromise occurs.
Threat: mirai Total URLs: 27 Active URLs: 27
| URL | Status | Threat | Date Added |
|---|---|---|---|
hxxp://210.208.116.107:58255/bin.sh | online | malware_download | 2026-08-18 |
hxxp://182.240.9.116:57352/i | online | malware_download | 2026-08-18 |
hxxp://210.208.110.147:36598/bin.sh | online | malware_download | 2026-08-18 |
hxxp://36.69.85.225:50581/i | online | malware_download | 2026-08-18 |
hxxp://125.112.59.94:60395/i | online | malware_download | 2026-08-18 |
hxxp://210.208.116.107:58255/i | online | malware_download | 2026-08-18 |
hxxp://210.208.111.220:46346/i | online | malware_download | 2026-08-18 |
hxxp://210.208.110.147:36598/i | online | malware_download | 2026-08-18 |
hxxp://111.72.43.182:49489/i | online | malware_download | 2026-08-18 |
hxxp://210.208.110.221:37492/bin.sh | online | malware_download | 2026-08-18 |
hxxp://210.208.110.20:60687/i | online | malware_download | 2026-08-18 |
hxxp://123.97.89.239:48639/i | online | malware_download | 2026-08-18 |
hxxp://123.97.89.239:48639/bin.sh | online | malware_download | 2026-08-18 |
hxxp://81.227.43.128:45355/i | online | malware_download | 2026-08-18 |
hxxp://115.54.224.69:44752/bin.sh | online | malware_download | 2026-08-18 |
hxxp://180.191.230.61:39051/bin.sh | online | malware_download | 2026-08-18 |
hxxp://210.208.104.156:49483/i | online | malware_download | 2026-08-18 |
hxxp://180.191.230.61:39051/i | online | malware_download | 2026-08-18 |
hxxp://223.151.74.149:48587/i | online | malware_download | 2026-08-18 |
hxxp://105.184.13.132:52355/i | online | malware_download | 2026-08-18 |
hxxp://115.54.224.69:44752/i | online | malware_download | 2026-08-18 |
hxxp://123.172.77.129:45661/i | online | malware_download | 2026-08-18 |
hxxp://210.208.104.156:49483/bin.sh | online | malware_download | 2026-08-18 |
hxxp://210.208.110.20:60687/bin.sh | online | malware_download | 2026-08-18 |
hxxp://210.208.110.221:37492/i | online | malware_download | 2026-08-18 |
// Hunt for DNS resolution of URLhaus malicious domains
// Threat: mirai
let malicious_domains = dynamic(["125.112.59.94", "210.208.116.107", "182.240.9.116", "111.72.43.182", "36.69.85.225", "210.208.110.221", "180.191.230.61", "210.208.110.20", "115.54.224.69", "210.208.104.156", "123.172.77.129", "81.227.43.128", "105.184.13.132", "210.208.111.220", "223.151.74.149", "210.208.106.68", "123.97.89.239", "210.208.110.147"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc
// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["125.112.59.94", "210.208.116.107", "182.240.9.116", "111.72.43.182", "36.69.85.225", "210.208.110.221", "180.191.230.61", "210.208.110.20", "115.54.224.69", "210.208.104.156", "123.172.77.129", "81.227.43.128", "105.184.13.132", "210.208.111.220", "223.151.74.149", "210.208.106.68", "123.97.89.239", "210.208.110.147"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc
| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
Here are specific false positive scenarios and corresponding filters for the URLhaus: mirai Malicious URLs detection rule in an enterprise environment:
IoT Device Firmware Updates via Cloud Repositories
*.cisco.com, *.ubnt.com) and specific IP ranges associated with the organization’s IoT management platform (e.g., Cisco Meraki Dashboard IPs).Scheduled Backup Jobs to Object Storage
Veeam.Backup.Service.exe, Commvault.Agents) accessing known cloud storage endpoints (e.g., *.s3.amazonaws.com).Third-Party API Integration for Device Management
SolarWinds.Orion.Core.exe) and exclude