URLhaus: mirai Malicious URLs

Hunt Hypothesis

This detection identifies network traffic accessing known Mirai botnet command-and-control URLs to uncover potential IoT device infections and early-stage bot recruitment. Proactive hunting is critical in Azure Sentinel to rapidly isolate compromised endpoints before adversaries leverage these devices for large-scale DDoS attacks or lateral movement within the enterprise network.

IOC Summary

Threat: mirai Total URLs: 8 Active URLs: 4

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: mirai
let malicious_domains = dynamic(["80.67.33.209", "176.65.139.228", "196.189.3.1"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["80.67.33.209", "176.65.139.228", "196.189.3.1"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 5 specific false positive scenarios for the URLhaus: mirai Malicious URLs detection rule, along with targeted filtering strategies:

• IoT Device Firmware Updates via Manufacturer Portals

  • Scenario: Enterprise IoT devices (e.g., Cisco Meraki cameras, Ubiquiti UniFi controllers) automatically query manufacturer update servers to check for firmware patches. These servers often host URLs that share the same domain or IP patterns as Mirai-infected botnets, triggering the rule when the device initiates a standard health check or download.
  • Filter/Exclusion: Create an exclusion list based on known vendor domains (e.g., meraki.cisco.com, ui.com) and specific IoT management subdomains. Additionally, filter by process name to exclude traffic originating from specific firmware agents like meraki-agent.exe or ubiquiti-updater.

• Scheduled Network Vulnerability Scans

  • Scenario: Automated vulnerability scanners (e.g., Tenable Nessus, Qualys) perform daily external network assessments. During these scans, the scanner probes a wide range of public URLs to test connectivity and security posture. If the scan target list includes known Mirai-infected endpoints or generic cloud storage buckets used for asset inventory, the rule triggers on legitimate scanning traffic rather than malicious infection.
  • Filter/Exclusion: Exclude traffic where the source process is identified as nessus.exe, qualys-agent, or openvas. Furthermore, apply a time-based filter to suppress alerts during known maintenance windows (e.g., 02:00–04:00 UTC) when these scheduled jobs are active.

• DevOps CI/CD Pipeline Artifact Retrieval

  • Scenario: Continuous Integration servers (e.g., Jenkins, GitLab Runner) frequently pull dependencies and container images from public registries or artifact repositories. If