URLhaus: mirai Malicious URLs

Hunt Hypothesis

This detection rule identifies network traffic connecting to five specific URLs known to host Mirai botnet malware, which adversaries leverage to compromise IoT devices and establish command-and-control channels. A proactive hunt is essential in Azure Sentinel to rapidly isolate infected endpoints before they can propagate lateral attacks or launch large-scale DDoS campaigns against the organization’s infrastructure.

IOC Summary

Threat: mirai Total URLs: 5 Active URLs: 5

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: mirai
let malicious_domains = dynamic(["103.77.246.150"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["103.77.246.150"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: Mirai Malicious URLs detection rule, including targeted filters and exclusions suitable for an enterprise environment:

• Scenario: Scheduled Firmware Update Scans by IoT Management Platforms

  • Context: Enterprise IoT management tools (e.g., Cisco Meraki Dashboard, Ubiquiti UniFi Controller, or BMC Helix) often run nightly scheduled jobs to check vendor repositories for firmware updates. These repositories frequently host URLs that share structural similarities with Mirai-infected devices, triggering the rule when the scanner queries a known update endpoint.
  • Filter/Exclusion: Create an exclusion list based on the specific source IP addresses of the IoT management servers and filter out traffic where the User-Agent header matches the vendor’s signature (e.g., Meraki-Update-Agent or UniFi-Firmware-Sync).

• Scenario: Automated Vulnerability Scanning by Security Appliances

  • Context: Internal vulnerability scanners like Tenable Nessus, Qualys, or Rapid7 InsightVM perform deep scans of network endpoints. During the “Host Discovery” and “Service Enumeration” phases, these tools may probe IoT device management interfaces that host URLs flagged by URLhaus as Mirai-related, mistaking the scanner’s probing activity for an active infection on a target device.
  • Filter/Exclusion: Exclude traffic originating from the dedicated IP ranges of the vulnerability scanning infrastructure. Additionally, apply a rule to suppress alerts where the destination port is standard management ports (e.g., TCP 443 or 80) and the connection duration is less than 5 seconds, indicating a probe rather than an active session.

• Scenario: Cloud Backup Agents Syncing with Vendor Repositories

  • Context: Enterprise backup solutions such as **Veeam Backup & Replication