← Back to SOC feed Coverage →

URLhaus: mirai Malicious URLs

ioc-hunt HIGH URLhaus
CommonSecurityLogDnsEvents
iocurlhaus
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at URLhaus →
Retrieved: 2026-08-19T11:00:00Z · Confidence: medium

Hunt Hypothesis

This hunt detects adversary behavior where compromised IoT or network devices initiate outbound connections to known Mirai botnet command-and-control URLs identified by URLhaus. A SOC team should proactively hunt for these indicators in Azure Sentinel to rapidly identify and isolate infected endpoints before they propagate lateral movement or launch large-scale DDoS attacks across the environment.

IOC Summary

Threat: mirai Total URLs: 26 Active URLs: 26

URLStatusThreatDate Added
hxxp://132.243.200.43/nullnet_bin_dir/nullnet_load.i686onlinemalware_download2026-08-19
hxxp://132.243.200.43/nullnet_bin_dir/nullnet_load.armonlinemalware_download2026-08-19
hxxp://132.243.200.43/nullnet_bin_dir/nullnet_load.i486onlinemalware_download2026-08-19
hxxp://120.28.194.30:35812/bin.shonlinemalware_download2026-08-19
hxxp://31.77.227.134/bins/pmpslonlinemalware_download2026-08-19
hxxp://132.243.200.43/nullnet_bin_dir/nullnet_load.mpslonlinemalware_download2026-08-19
hxxp://31.77.227.134/bins/pm68konlinemalware_download2026-08-19
hxxp://132.243.200.43/nullnet_bin_dir/nullnet_load.arm7onlinemalware_download2026-08-19
hxxp://196.189.130.28:43450/ionlinemalware_download2026-08-19
hxxp://210.208.110.130:49996/bin.shonlinemalware_download2026-08-19
hxxp://132.243.200.43/nullnet_bin_dir/nullnet_load.arconlinemalware_download2026-08-19
hxxp://132.243.200.43/nullnet_bin_dir/nullnet_load.arm6onlinemalware_download2026-08-19
hxxp://31.77.227.134/bins/psh4onlinemalware_download2026-08-19
hxxp://132.243.200.43/nullnet_bin_dir/nullnet_load.arm5onlinemalware_download2026-08-19
hxxp://31.77.227.134/bins/pppconlinemalware_download2026-08-19
hxxp://113.58.130.128:38469/ionlinemalware_download2026-08-19
hxxp://132.243.200.43/nullnet_bin_dir/nullnet_load.x86onlinemalware_download2026-08-19
hxxp://132.243.200.43/nullnet_bin_dir/nullnet_load.x86_64onlinemalware_download2026-08-19
hxxp://110.136.40.34:41510/ionlinemalware_download2026-08-19
hxxp://182.245.28.97:40240/ionlinemalware_download2026-08-19
hxxp://31.77.227.134/bins/parm7onlinemalware_download2026-08-19
hxxp://37.78.12.145:45921/bin.shonlinemalware_download2026-08-19
hxxp://132.243.200.43/nullnet_bin_dir/nullnet_load.sh4onlinemalware_download2026-08-19
hxxp://132.243.200.43/nullnet_bin_dir/nullnet_load.mipsonlinemalware_download2026-08-19
hxxp://132.243.200.43/nullnet_bin_dir/nullnet_load.m68konlinemalware_download2026-08-19

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: mirai
let malicious_domains = dynamic(["37.78.12.145", "113.58.130.128", "196.189.130.28", "210.208.110.130", "31.77.227.134", "120.28.194.30", "110.136.40.34", "132.243.200.43", "182.245.28.97"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["37.78.12.145", "113.58.130.128", "196.189.130.28", "210.208.110.130", "31.77.227.134", "120.28.194.30", "110.136.40.34", "132.243.200.43", "182.245.28.97"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

Sentinel TableNotes
CommonSecurityLogEnsure this data connector is enabled
DnsEventsEnsure this data connector is enabled

References

False Positive Guidance

Here are 5 specific false positive scenarios for the URLhaus: mirai Malicious URLs detection rule, along with targeted filters and exclusions:

Original source: https://urlhaus.abuse.ch/