This hunt targets the presence of known Mirai botnet command-and-control (C2) URLs, indicating that an adversary is actively communicating with or downloading payloads from infrastructure associated with this widespread IoT malware family. Proactively hunting for these indicators in Azure Sentinel is critical to identify compromised assets early, as Mirai infections often facilitate lateral movement and DDoS attacks that can disrupt network availability and data integrity.
Threat: mirai Total URLs: 20 Active URLs: 20
| URL | Status | Threat | Date Added |
|---|---|---|---|
hxxp://94.156.166.167:38753/i | online | malware_download | 2026-09-24 |
hxxp://112.198.195.68:36394/i | online | malware_download | 2026-09-24 |
hxxp://171.213.194.183:39393/i | online | malware_download | 2026-09-24 |
hxxp://182.52.72.138:39258/i | online | malware_download | 2026-09-24 |
hxxp://182.52.72.138:39258/bin.sh | online | malware_download | 2026-09-24 |
hxxp://185.39.181.103:58644/i | online | malware_download | 2026-09-24 |
hxxp://222.127.71.33:45242/i | online | malware_download | 2026-09-24 |
hxxp://223.151.255.165:47591/bin.sh | online | malware_download | 2026-09-24 |
hxxp://217.60.103.135/mpsl | online | malware_download | 2026-09-24 |
hxxp://217.60.103.135/arm5 | online | malware_download | 2026-09-24 |
hxxp://134.255.106.119:37216/i | online | malware_download | 2026-09-24 |
hxxp://45.224.83.130:54008/bin.sh | online | malware_download | 2026-09-24 |
hxxp://180.191.34.236:33816/bin.sh | online | malware_download | 2026-09-24 |
hxxp://60.13.81.224:56483/i | online | malware_download | 2026-09-24 |
hxxp://200.115.102.246:53528/i | online | malware_download | 2026-09-24 |
hxxp://60.13.81.224:56483/bin.sh | online | malware_download | 2026-09-24 |
hxxp://94.156.166.84:52290/i | online | malware_download | 2026-09-24 |
hxxp://182.126.41.95:59405/i | online | malware_download | 2026-09-24 |
hxxp://105.184.83.252:45043/i | online | malware_download | 2026-09-24 |
hxxp://103.172.186.170:56160/bin.sh | online | malware_download | 2026-09-24 |
// Hunt for DNS resolution of URLhaus malicious domains
// Threat: mirai
let malicious_domains = dynamic(["200.115.102.246", "171.213.194.183", "60.13.81.224", "45.224.83.130", "185.39.181.103", "105.184.83.252", "217.60.103.135", "182.126.41.95", "182.52.72.138", "134.255.106.119", "222.127.71.33", "223.151.255.165", "180.191.34.236", "103.172.186.170", "94.156.166.167", "94.156.166.84", "112.198.195.68"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc
// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["200.115.102.246", "171.213.194.183", "60.13.81.224", "45.224.83.130", "185.39.181.103", "105.184.83.252", "217.60.103.135", "182.126.41.95", "182.52.72.138", "134.255.106.119", "222.127.71.33", "223.151.255.165", "180.191.34.236", "103.172.186.170", "94.156.166.167", "94.156.166.84", "112.198.195.68"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc
| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
IoT Device Firmware Updates via Local Network Scanners
nmap or custom Python scripts to scan IoT devices (cameras, smart plugs) for firmware vulnerabilities. If a device is configured to pull updates from a known Mirai botnet C2 domain (often reused for legitimate update servers in legacy hardware), the HTTP request will match the URLhaus list.IoT-Management subnet or specific service accounts (e.g., svc-firmware-updater) when the destination port is 80/443 and the user-agent string contains curl/7.x or python-requests.Legacy Application Health Checks
/index.php or /update on a specific IP). This is not malicious but a quirk of the application’s configuration file.app-legacy-erp) and the exact URL path if the source is a known internal IP range (e.g., 10.20.0.0/24) and the process is java.exe or iisexpress.exe.Web Scraping or Monitoring Tools
curl, wget, or Postman to monitor external endpoints or scrape data. If the monitoring list includes a URL that is also tagged as Mirai in URLhaus (due to a shared IP/domain), the legitimate request triggers the alert.