This hunt targets the presence of known Mirai botnet command-and-control (C2) URLs to identify hosts that may be compromised by this IoT-focused malware family. Proactively searching for these indicators in Azure Sentinel allows the SOC team to detect lateral movement or beaconing activity before the botnet can fully propagate across the network or initiate a distributed denial-of-service (DDoS) attack.
Threat: mirai Total URLs: 19 Active URLs: 17
| URL | Status | Threat | Date Added |
|---|---|---|---|
hxxp://112.109.210.146:36461/i | online | malware_download | 2026-09-25 |
hxxp://110.139.32.108:51018/i | online | malware_download | 2026-09-25 |
hxxp://110.81.120.188:34777/i | online | malware_download | 2026-09-25 |
hxxp://101.59.79.119:48212/i | online | malware_download | 2026-09-25 |
hxxp://27.17.159.55:50801/i | offline | malware_download | 2026-09-25 |
hxxp://101.59.79.119:48212/bin.sh | online | malware_download | 2026-09-25 |
hxxp://115.58.181.174:33235/i | online | malware_download | 2026-09-25 |
hxxp://119.99.250.231:44156/i | online | malware_download | 2026-09-25 |
hxxp://116.68.162.210:54893/i | online | malware_download | 2026-09-25 |
hxxp://154.223.128.222:59623/i | online | malware_download | 2026-09-25 |
hxxp://180.180.120.122:51623/i | online | malware_download | 2026-09-25 |
hxxp://170.0.60.30:33867/i | online | malware_download | 2026-09-25 |
hxxp://27.23.64.85:47259/i | online | malware_download | 2026-09-25 |
hxxp://47.212.193.38:35923/i | online | malware_download | 2026-09-25 |
hxxp://47.212.193.38:35923/bin.sh | online | malware_download | 2026-09-25 |
hxxp://110.138.8.75:52847/i | online | malware_download | 2026-09-25 |
hxxp://105.187.36.75:47505/i | online | malware_download | 2026-09-25 |
hxxp://105.187.36.75:47505/bin.sh | online | malware_download | 2026-09-25 |
hxxp://105.184.105.234:37099/i | offline | malware_download | 2026-09-25 |
// Hunt for DNS resolution of URLhaus malicious domains
// Threat: mirai
let malicious_domains = dynamic(["27.23.64.85", "119.99.250.231", "112.109.210.146", "170.0.60.30", "47.212.193.38", "105.187.36.75", "116.68.162.210", "154.223.128.222", "115.58.181.174", "110.139.32.108", "110.81.120.188", "180.180.120.122", "101.59.79.119", "110.138.8.75"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["27.23.64.85", "119.99.250.231", "112.109.210.146", "170.0.60.30", "47.212.193.38", "105.187.36.75", "116.68.162.210", "154.223.128.222", "115.58.181.174", "110.139.32.108", "110.81.120.188", "180.180.120.122", "101.59.79.119", "110.138.8.75"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
IoT Device Firmware Updates: Mirai is notorious for targeting IoT devices (e.g., IP cameras, DVRs, routers) that have hardcoded or default credentials. Legitimate firmware update servers or vendor-specific update endpoints might use URL patterns similar to those in the URLhaus list, especially if the device is polling a known vendor CDN.
192.168.10.0/24) or specific vendor domains (e.g., *.dahua.com, *.hikvision.com) if the URL path matches a firmware update pattern (/firmware/, /update/).Legacy Application Health Checks: Some older enterprise applications or custom internal tools may use hardcoded URLs for health checks or license validation that coincidentally match a Mirai URL due to similar path structures (e.g., /index.php, /admin/, /login/). These are often triggered by scheduled cron jobs or Windows Task Scheduler.
svc-app-health, svc-license-check) or exclude traffic from application server IPs (e.g., 10.20.30.0/24) when the user agent string identifies a known legacy tool (e.g., Apache-HttpClient/4.5, Java/1.8).Web Scraping or Monitoring Tools: Tools like UptimeRobot, Pingdom, or custom Python/Node.js monitoring scripts may probe internal or external endpoints to verify availability. If the monitoring script is configured to check a URL that happens to be in the URLhaus list (perhaps due to a shared hosting provider or a misconfigured test endpoint), it will trigger the rule.