This hunt detects adversary behavior involving traffic to known Mirai botnet command-and-control or infection sources identified by URLhaus, which are frequently used to compromise IoT devices and initiate large-scale DDoS attacks. A SOC team should proactively hunt for these indicators in Azure Sentinel to rapidly identify early-stage infections within their network perimeter and prevent the lateral spread of Mirai variants before they can orchestrate significant disruption.
Threat: mirai Total URLs: 24 Active URLs: 24
| URL | Status | Threat | Date Added |
|---|---|---|---|
hxxp://115.197.32.42:36155/i | online | malware_download | 2026-08-15 |
hxxp://36.70.226.107:53300/i | online | malware_download | 2026-08-15 |
hxxp://182.240.11.199:57352/i | online | malware_download | 2026-08-15 |
hxxp://200.115.102.246:32939/i | online | malware_download | 2026-08-15 |
hxxp://115.230.79.157:47435/bin.sh | online | malware_download | 2026-08-15 |
hxxp://83.168.69.141/p1.sh | online | malware_download | 2026-08-15 |
hxxp://110.37.22.216:55052/i | online | malware_download | 2026-08-15 |
hxxp://110.37.44.119:37578/bin.sh | online | malware_download | 2026-08-15 |
hxxp://196.189.35.226:40707/i | online | malware_download | 2026-08-15 |
hxxp://183.23.133.4:35951/bin.sh | online | malware_download | 2026-08-15 |
hxxp://116.53.20.49:42959/i | online | malware_download | 2026-08-15 |
hxxp://110.37.44.119:37578/i | online | malware_download | 2026-08-15 |
hxxp://182.129.144.219:54088/i | online | malware_download | 2026-08-15 |
hxxp://210.208.110.130:40967/bin.sh | online | malware_download | 2026-08-15 |
hxxp://124.235.207.2:39666/i | online | malware_download | 2026-08-15 |
hxxp://27.156.139.177:51830/i | online | malware_download | 2026-08-15 |
hxxp://123.185.91.133:52353/bin.sh | online | malware_download | 2026-08-15 |
hxxp://182.85.43.191:49489/i | online | malware_download | 2026-08-15 |
hxxp://140.237.44.234:41542/bin.sh | online | malware_download | 2026-08-15 |
hxxp://140.237.44.234:41542/i | online | malware_download | 2026-08-15 |
hxxp://27.156.139.177:51830/bin.sh | online | malware_download | 2026-08-15 |
hxxp://182.85.43.191:49489/bin.sh | online | malware_download | 2026-08-15 |
hxxp://79.106.74.167:44091/i | online | malware_download | 2026-08-15 |
hxxp://196.189.35.226:40707/bin.sh | online | malware_download | 2026-08-15 |
// Hunt for DNS resolution of URLhaus malicious domains
// Threat: mirai
let malicious_domains = dynamic(["182.129.144.219", "200.115.102.246", "115.230.79.157", "182.85.43.191", "36.70.226.107", "116.53.20.49", "83.168.69.141", "182.240.11.199", "140.237.44.234", "210.208.110.130", "123.185.91.133", "110.37.44.119", "124.235.207.2", "196.189.35.226", "183.23.133.4", "79.106.74.167", "115.197.32.42", "27.156.139.177", "110.37.22.216"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc
// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["182.129.144.219", "200.115.102.246", "115.230.79.157", "182.85.43.191", "36.70.226.107", "116.53.20.49", "83.168.69.141", "182.240.11.199", "140.237.44.234", "210.208.110.130", "123.185.91.133", "110.37.44.119", "124.235.207.2", "196.189.35.226", "183.23.133.4", "79.106.74.167", "115.197.32.42", "27.156.139.177", "110.37.22.216"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc
| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
Here are 5 specific false positive scenarios for the URLhaus: mirai Malicious URLs detection rule, along with targeted filters and exclusions suitable for an enterprise environment:
IoT Device Firmware Updates via Vendor Gateways
Group: IoT-Infrastructure) or whitelist known vendor update domains (e.g., *.hikvision.com, *.meraki.cisco.com) if they consistently trigger this rule during scheduled maintenance windows.Scheduled Security Scanning by EDR Agents
User: svc-crowdstrike-agent or Host Group: Security-Servers) and filter out alerts occurring strictly between 02:00–04:00 UTC, which aligns with standard definition update schedules.Automated Backup and Replication Jobs