This hunt targets the presence of known Mirai botnet indicators of compromise, which often signal compromised IoT devices or servers being leveraged for large-scale DDoS attacks or lateral movement. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify and isolate infected assets before they are fully integrated into the botnet, thereby reducing the risk of network congestion and service disruption.
Malware Family: Mirai Total IOCs: 6 IOC Types: url
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| url | hxxp://156[.]248[.]73[.]84:8081/?h=156[.]248[.]73[.]84&p=8081&t=ws&a=l32&stage=true | payload_delivery | 2026-09-20 | 95% |
| url | hxxp://47[.]254[.]173[.]184:8443/?h=47[.]254[.]173[.]184&p=8443&t=ws&a=l32&stage=true | payload_delivery | 2026-09-20 | 95% |
| url | hxxp://193[.]160[.]32[.]138:8085/?h=193[.]160[.]32[.]138&p=8085&t=ws&a=l64&stage=true | payload_delivery | 2026-09-20 | 95% |
| url | hxxp://178[.]16[.]53[.]91:8443/?h=178[.]16[.]53[.]91&p=8443&t=ws&a=l64&stage=true | payload_delivery | 2026-09-20 | 95% |
| url | hxxp://107[.]161[.]168[.]217/?h=107[.]161[.]168[.]217&p=80&t=ws&a=l64&stage=true | payload_delivery | 2026-09-20 | 95% |
| url | hxxp://89[.]34[.]227[.]96:8088/?h=89[.]34[.]227[.]96&p=8088&t=ws&a=l64&stage=true | payload_delivery | 2026-09-20 | 95% |
// Hunt for access to known malicious URLs
// Source: ThreatFox - Mirai
let malicious_urls = dynamic(["http://156.248.73.84:8081/?h=156.248.73.84&p=8081&t=ws&a=l32&stage=true", "http://47.254.173.184:8443/?h=47.254.173.184&p=8443&t=ws&a=l32&stage=true", "http://193.160.32.138:8085/?h=193.160.32.138&p=8085&t=ws&a=l64&stage=true", "http://178.16.53.91:8443/?h=178.16.53.91&p=8443&t=ws&a=l64&stage=true", "http://107.161.168.217/?h=107.161.168.217&p=80&t=ws&a=l64&stage=true", "http://89.34.227.96:8088/?h=89.34.227.96&p=8088&t=ws&a=l64&stage=true"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
UrlClickEvents | Ensure this data connector is enabled |
Legacy IoT Device Firmware Updates:
Ansible or Puppet) pushes firmware updates to a fleet of unmanaged IoT devices (such as IP cameras or smart thermostats) that use default or known Mirai-associated hash values or network endpoints for their update servers.10.20.0.0/24) and the destination port is standard HTTP/HTTPS (80/443) rather than the specific Mirai botnet ports (e.g., 23, 2323, 23232).Network Scanning by Security Tools:
Nmap or Qualys probes the internal network, sending packets to known Mirai IOCs (such as specific UDP ports or TCP ports 23, 2323, 23232) to identify unpatched devices, triggering the detection rule on the scanning host or the target.nmap.exe, qualys_agent.exe) or where the source IP is the designated security scanning appliance (e.g., 10.50.1.5).Development Environment Testing:
Docker containers or Vagrant boxes that simulate Mirai botnet behavior to validate detection rules, causing the containerized environment to generate traffic matching the IOCs.