URLhaus: mirai Malicious URLs

Hunt Hypothesis

This detection rule identifies adversary behavior where Mirai malware exploits IoT devices with default credentials to establish command-and-control channels via malicious URLs listed in the URLhaus threat intelligence feed. A SOC team should proactively hunt for this activity within Azure Sentinel because Mirai’s ability to rapidly infect vulnerable IoT infrastructure can lead to large-scale botnet recruitment and potential network-wide disruption if left unaddressed.

IOC Summary

Threat: mirai Total URLs: 16 Active URLs: 16

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: mirai
let malicious_domains = dynamic(["160.119.71.134", "165.98.243.83"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["160.119.71.134", "165.98.243.83"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: mirai Malicious URLs detection rule in an enterprise environment, along with suggested filters and exclusions:

• IoT Firmware Update Scans by Network Management Tools

  • Scenario: Automated network management platforms like Cisco DNA Center, SolarWinds NMS, or Ubiquiti UniFi Controller periodically query IoT device endpoints (cameras, printers, smart thermostats) to check for firmware updates. These tools often connect to vendor update servers that host Mirai-related signature databases or update manifests, triggering the rule due to the presence of known Mirai URL patterns in the response headers or redirect chains.
  • Filter/Exclusion: Create a whitelist exclusion based on the Source IP range of the network management server (e.g., 10.20.50.x) and restrict the detection to exclude traffic where the User-Agent string contains specific identifiers like Cisco-DNA, SolarWinds-Scanner, or UniFi-Controller.

• Scheduled Vulnerability Assessment Scans on IoT Subnets

  • Scenario: Security teams run scheduled jobs using tools like Tenable Nessus, Qualys, or Rapid7 InsightVM to scan the IoT subnet for vulnerabilities. During these scans, the tool actively probes default ports (e.g., 80, 443, 1900) on devices that may be running legacy firmware with Mirai signatures. The scanner’s interaction with the device’s update endpoint mimics a potential compromise attempt by generating traffic to known Mirai command-and-control URLs.
  • Filter/Exclusion: Implement an exclusion rule based on Time Windows (e.g., exclude alerts generated between 02:00 and 04:00 UTC) combined with the Destination Port. If