This hypothesis targets potential Mirai botnet infections by identifying assets that have communicated with known malicious URLs, indicating a compromised host likely used for DDoS amplification or lateral movement. Proactively hunting for these indicators in Azure Sentinel allows the SOC to isolate affected workloads before the botnet can fully propagate across the network or initiate large-scale attacks.
Threat: mirai Total URLs: 3 Active URLs: 2
| URL | Status | Threat | Date Added |
|---|---|---|---|
hxxp://183.151.171.156:58331/i | online | malware_download | 2026-09-02 |
hxxp://183.151.171.156:58331/bin.sh | online | malware_download | 2026-09-02 |
hxxp://105.225.107.183:39153/bin.sh | offline | malware_download | 2026-09-02 |
// Hunt for DNS resolution of URLhaus malicious domains
// Threat: mirai
let malicious_domains = dynamic(["183.151.171.156"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["183.151.171.156"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
10.20.0.0/16) or specific device MAC prefixes known to be part of the embedded fleet.Java/1.8, Shockwave Flash) or exclude specific legacy application hostnames from the detection scope.192.168.100.50) or tag alerts with a PenTest label during scheduled test windows.backup-agent.exe or dr-verify.sh and restrict the exclusion to specific scheduled job times (e.g., 02:00-04:00 UTC).