URLhaus: mirai Malicious URLs

Hunt Hypothesis

This rule detects outbound connections to known malicious URLs associated with the Mirai botnet, indicating potential IoT device compromise or lateral movement attempts. Proactively hunting for these indicators allows the SOC to identify infected endpoints early, preventing them from joining large-scale DDoS swarms or serving as footholds for further network exploitation.

IOC Summary

Threat: mirai Total URLs: 4 Active URLs: 3

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: mirai
let malicious_domains = dynamic(["222.127.243.18", "222.185.171.150", "196.189.101.82"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["222.127.243.18", "222.185.171.150", "196.189.101.82"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Scenario: IoT Firmware Update via HTTP Many legacy IoT devices (e.g., IP cameras, smart plugs) use plain HTTP for firmware updates or configuration syncs. If a Mirai-infected device or a legitimate device communicating with a known Mirai C2 URL (often due to shared infrastructure or misconfigured DNS) performs a routine update, it may trigger the rule.

  • Filter/Exclusion: Exclude traffic from specific IoT VLANs or subnets (e.g., 192.168.10.0/24) if they are segmented and monitored by a dedicated IoT firewall. Alternatively, whitelist specific firmware update endpoints if they are internal or trusted third-party CDNs.

• Scenario: Scheduled Log Rotation or Backup Jobs Some enterprise backup or log aggregation tools (e.g., custom Python scripts, rsync over HTTP, or specific NAS configurations) may periodically push data to or pull from a URL that coincidentally matches a Mirai C2 domain (especially if the C2 is a legitimate domain hijacked or used for dual-use purposes). This is common in environments with ad-hoc scripting.

  • Filter/Exclusion: Exclude traffic from known service accounts or specific hostnames (e.g., backup-server-01, log-aggregator-02) when the destination port is 80/443 and the source is a non-interactive service account.

• Scenario: Developer Testing with Mirai Samples Security teams or developers may intentionally download Mirai samples or test C2 communication in isolated lab environments or staging servers to validate detection rules. These hosts often have predictable naming conventions (e.g., lab-iot-01, staging-mirai-test).

  • Filter/Exclusion: Exclude hosts with naming conventions like *lab*, `staging