URLhaus: mirai Malicious URLs

Hunt Hypothesis

This hunt targets adversary behavior where IoT devices or network endpoints communicate with known Mirai botnet command-and-control servers via specific malicious URLs identified by URLhaus. Proactively hunting for these connections in Azure Sentinel is critical to detect early-stage botnet infections and prevent lateral movement before the compromised assets are leveraged for large-scale DDoS attacks.

IOC Summary

Threat: mirai Total URLs: 3 Active URLs: 2

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: mirai
let malicious_domains = dynamic(["49.79.167.219"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["49.79.167.219"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios for the URLhaus: mirai Malicious URLs detection rule in an enterprise environment, along with targeted filtering strategies:

• Automated Firmware Update Scans by Network Management Tools

  • Scenario: Enterprise network management platforms like SolarWinds NPM, ManageEngine OpManager, or Cisco Prime Infrastructure periodically scan IoT device inventories (cameras, routers, printers) to check for firmware versions. These tools often ping known Mirai-infected IP ranges or query public vulnerability databases that host Mirai-related signatures, triggering the rule when they access URLs associated with these checks.
  • Filter/Exclusion: Create an exclusion based on the Source Host (e.g., Host_Name contains "SolarWinds-Server" or IP in 10.20.50.0/24) and limit the rule to exclude traffic originating from known management VLANs during scheduled maintenance windows (e.g., 02:00–04:00 UTC).

• Security Information and Event Management (SIEM) Enrichment Jobs

  • Scenario: SIEM platforms such as Splunk, Microsoft Sentinel, or IBM QRadar run scheduled enrichment jobs to correlate internal logs with external threat intelligence feeds. A specific job might query the URLhaus API or a third-party reputation service (like VirusTotal) to validate URLs found in web proxy logs, inadvertently generating hits for Mirai-tagged URLs even when no actual malware infection is present on the endpoint.
  • Filter/Exclusion: Exclude traffic where the User Agent string contains specific SIEM job identifiers (e.g., User-Agent: "Splunk-Enrichment-Job-v2") or filter by process name if the detection includes process context (e.g., exclude processes named `splunkd.exe