This hunt detects adversary behavior where compromised IoT or network devices initiate outbound connections to known Mirai botnet command-and-control URLs identified by URLhaus. A SOC team should proactively hunt for these indicators in Azure Sentinel to rapidly identify and isolate infected endpoints before they propagate lateral movement or launch large-scale DDoS attacks across the environment.
Threat: mirai Total URLs: 26 Active URLs: 26
| URL | Status | Threat | Date Added |
|---|---|---|---|
hxxp://132.243.200.43/nullnet_bin_dir/nullnet_load.i686 | online | malware_download | 2026-08-19 |
hxxp://132.243.200.43/nullnet_bin_dir/nullnet_load.arm | online | malware_download | 2026-08-19 |
hxxp://132.243.200.43/nullnet_bin_dir/nullnet_load.i486 | online | malware_download | 2026-08-19 |
hxxp://120.28.194.30:35812/bin.sh | online | malware_download | 2026-08-19 |
hxxp://31.77.227.134/bins/pmpsl | online | malware_download | 2026-08-19 |
hxxp://132.243.200.43/nullnet_bin_dir/nullnet_load.mpsl | online | malware_download | 2026-08-19 |
hxxp://31.77.227.134/bins/pm68k | online | malware_download | 2026-08-19 |
hxxp://132.243.200.43/nullnet_bin_dir/nullnet_load.arm7 | online | malware_download | 2026-08-19 |
hxxp://196.189.130.28:43450/i | online | malware_download | 2026-08-19 |
hxxp://210.208.110.130:49996/bin.sh | online | malware_download | 2026-08-19 |
hxxp://132.243.200.43/nullnet_bin_dir/nullnet_load.arc | online | malware_download | 2026-08-19 |
hxxp://132.243.200.43/nullnet_bin_dir/nullnet_load.arm6 | online | malware_download | 2026-08-19 |
hxxp://31.77.227.134/bins/psh4 | online | malware_download | 2026-08-19 |
hxxp://132.243.200.43/nullnet_bin_dir/nullnet_load.arm5 | online | malware_download | 2026-08-19 |
hxxp://31.77.227.134/bins/pppc | online | malware_download | 2026-08-19 |
hxxp://113.58.130.128:38469/i | online | malware_download | 2026-08-19 |
hxxp://132.243.200.43/nullnet_bin_dir/nullnet_load.x86 | online | malware_download | 2026-08-19 |
hxxp://132.243.200.43/nullnet_bin_dir/nullnet_load.x86_64 | online | malware_download | 2026-08-19 |
hxxp://110.136.40.34:41510/i | online | malware_download | 2026-08-19 |
hxxp://182.245.28.97:40240/i | online | malware_download | 2026-08-19 |
hxxp://31.77.227.134/bins/parm7 | online | malware_download | 2026-08-19 |
hxxp://37.78.12.145:45921/bin.sh | online | malware_download | 2026-08-19 |
hxxp://132.243.200.43/nullnet_bin_dir/nullnet_load.sh4 | online | malware_download | 2026-08-19 |
hxxp://132.243.200.43/nullnet_bin_dir/nullnet_load.mips | online | malware_download | 2026-08-19 |
hxxp://132.243.200.43/nullnet_bin_dir/nullnet_load.m68k | online | malware_download | 2026-08-19 |
// Hunt for DNS resolution of URLhaus malicious domains
// Threat: mirai
let malicious_domains = dynamic(["37.78.12.145", "113.58.130.128", "196.189.130.28", "210.208.110.130", "31.77.227.134", "120.28.194.30", "110.136.40.34", "132.243.200.43", "182.245.28.97"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc
// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["37.78.12.145", "113.58.130.128", "196.189.130.28", "210.208.110.130", "31.77.227.134", "120.28.194.30", "110.136.40.34", "132.243.200.43", "182.245.28.97"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc
| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
Here are 5 specific false positive scenarios for the URLhaus: mirai Malicious URLs detection rule, along with targeted filters and exclusions:
IoT Device Firmware Updates via Cloud Repositories
10.50.x.x) or add the known vendor repository domains (e.g., firmware.cisco.com, updates.unifi.network) to the rule’s allow-list based on their FQDNs, excluding traffic from these sources regardless of URL hash matches.Automated Security Scanning by Vulnerability Management Tools
svc-nessus-scanner or IP range 192.168.10.50). Additionally, filter out requests where the User-Agent string contains keywords like “Nessus”, “Qualys”, or “Rapid7”.**Software Supply Chain and Dependency Checks by CI/CD