This hunt targets the presence of known Mirai botnet command-and-control (C2) URLs to identify hosts potentially compromised by this IoT-focused malware. Proactively hunting for these indicators in Azure Sentinel allows the SOC to detect lateral movement or beaconing activity before the botnet can fully propagate and execute its distributed denial-of-service (DDoS) capabilities.
Threat: mirai Total URLs: 26 Active URLs: 26
| URL | Status | Threat | Date Added |
|---|---|---|---|
hxxp://124.6.167.121:45202/Mozi.m | online | malware_download | 2026-09-03 |
hxxp://112.198.186.249:39708/i | online | malware_download | 2026-09-03 |
hxxp://182.120.43.111:47591/i | online | malware_download | 2026-09-03 |
hxxp://112.198.130.112:42547/bin.sh | online | malware_download | 2026-09-03 |
hxxp://130.12.209.147:43312/i | online | malware_download | 2026-09-03 |
hxxp://124.234.200.151:54858/bin.sh | online | malware_download | 2026-09-03 |
hxxp://114.226.120.28:35996/bin.sh | online | malware_download | 2026-09-03 |
hxxp://179.108.89.220:35169/i | online | malware_download | 2026-09-03 |
hxxp://36.70.196.73:60650/i | online | malware_download | 2026-09-03 |
hxxp://66.212.186.193:57081/i | online | malware_download | 2026-09-03 |
hxxp://120.28.201.138:57662/bin.sh | online | malware_download | 2026-09-03 |
hxxp://114.226.120.28:35996/i | online | malware_download | 2026-09-03 |
hxxp://220.177.11.172:54471/bin.sh | online | malware_download | 2026-09-03 |
hxxp://222.127.50.102:51464/i | online | malware_download | 2026-09-03 |
hxxp://113.221.76.194:54955/Mozi.m | online | malware_download | 2026-09-03 |
hxxp://179.108.89.220:35169/bin.sh | online | malware_download | 2026-09-03 |
hxxp://120.28.161.11:57965/bin.sh | online | malware_download | 2026-09-03 |
hxxp://180.191.32.197:49164/bin.sh | online | malware_download | 2026-09-03 |
hxxp://60.215.197.174:38401/bin.sh | online | malware_download | 2026-09-03 |
hxxp://175.9.166.233:50484/bin.sh | online | malware_download | 2026-09-03 |
hxxp://180.191.32.197:49164/i | online | malware_download | 2026-09-03 |
hxxp://105.184.46.169:45057/bin.sh | online | malware_download | 2026-09-03 |
hxxp://105.184.46.169:45057/i | online | malware_download | 2026-09-03 |
hxxp://114.228.186.181:50519/Mozi.a | online | malware_download | 2026-09-03 |
hxxp://125.46.234.68:43013/i | online | malware_download | 2026-09-03 |
// Hunt for DNS resolution of URLhaus malicious domains
// Threat: mirai
let malicious_domains = dynamic(["220.177.11.172", "130.12.209.147", "120.28.201.138", "105.184.46.169", "222.127.50.102", "182.120.43.111", "179.108.89.220", "112.198.186.249", "114.226.120.28", "175.9.166.233", "113.221.76.194", "36.70.196.73", "124.6.167.121", "66.212.186.193", "112.198.130.112", "112.113.68.159", "60.215.197.174", "114.228.186.181", "124.234.200.151", "120.28.161.11", "125.46.234.68", "180.191.32.197"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc
// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["220.177.11.172", "130.12.209.147", "120.28.201.138", "105.184.46.169", "222.127.50.102", "182.120.43.111", "179.108.89.220", "112.198.186.249", "114.226.120.28", "175.9.166.233", "113.221.76.194", "36.70.196.73", "124.6.167.121", "66.212.186.193", "112.198.130.112", "112.113.68.159", "60.215.197.174", "114.228.186.181", "124.234.200.151", "120.28.161.11", "125.46.234.68", "180.191.32.197"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc
| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
10.20.0.0/24) where the User-Agent string matches common IoT firmware agents (e.g., Go-http/1.1, curl/7.x, or vendor-specific strings like TP-Link, Hikvision) and the destination port is 80/443.java.exe, dotnet.exe, nginx.exe) and the connection originates from a server role (e.g., Web Server, App Server) rather than a workstation.jenkins-slave-01, `