Mirai Botnet Checkin Pattern Detected

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•3

This rule detects a specific HTTP POST request pattern associated with the Mirai botnet's check-in mechanism. It looks for HTTP POST requests to the '/report' URI with a body size between 21 and 99 bytes. A threshold of 10 such requests from the same source within 60 seconds triggers the alert, indicating potential botnet activity.