URLhaus: mirai Malicious URLs

Hunt Hypothesis

This detection identifies Mirai malware infections by monitoring for malicious URLs associated with the botnet’s exploitation of IoT devices through default credentials and weak security configurations. A SOC team should proactively hunt for this behavior in Azure Sentinel to rapidly isolate compromised endpoints before they are recruited into a large-scale DDoS attack, thereby preventing widespread network disruption.

IOC Summary

Threat: mirai Total URLs: 6 Active URLs: 5

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: mirai
let malicious_domains = dynamic(["179.108.89.220", "114.228.239.251", "36.69.88.195", "140.237.6.81", "103.172.186.165"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["179.108.89.220", "114.228.239.251", "36.69.88.195", "140.237.6.81", "103.172.186.165"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: mirai Malicious URLs detection rule in an enterprise environment, including suggested filters and exclusions:

• Scenario: Automated Firmware Updates from IoT Vendor Portals

  • Context: Enterprise-managed IoT devices (e.g., IP cameras, smart thermostats) often connect to vendor update servers (such as firmware.hikvision.com or update.arlo.com) to check for patches. These URLs may be flagged because the traffic pattern resembles Mirai’s initial reconnaissance phase, where infected bots scan and download payloads from external sources.
  • Filter/Exclusion: Create an allowlist of known vendor update domains in the URL filtering policy. If using a SIEM like Splunk or Elastic, add a correlation rule that excludes alerts where the source IP belongs to the internal “IoT Management” VLAN and the destination domain is part of the pre-approved vendor_update_list.csv.

• Scenario: Scheduled Asset Discovery by Network Monitoring Tools

  • Context: Tools like SolarWinds NPM, PRTG, or ** Lansweeper** perform periodic network scans to discover new devices and verify connectivity. These tools often send HTTP/HTTPS requests to known IP ranges, which can mimic the Mirai bot’s behavior of probing default ports (e.g., port 80/443) on various endpoints.
  • Filter/Exclusion: Exclude traffic originating from specific monitoring service accounts or IPs (e.g., 192.168.10.5 for the SolarWinds server). In the detection logic, add a condition to suppress alerts where the User-Agent string contains identifiers like “SolarWinds”, “PRTG Network Monitor,” or “Lansweeper Agent.”

• Scenario: CI/CD Pipeline Artifact Downloads *