URLhaus: mirai Malicious URLs

Hunt Hypothesis

This hunt targets adversary behavior where IoT devices or internal workstations communicate with known Mirai botnet command-and-control infrastructure via specific malicious URLs identified by URLhaus. Proactively hunting for these indicators in Azure Sentinel is critical to detect early-stage botnet infections before they escalate into large-scale DDoS attacks or lateral movement campaigns within the network.

IOC Summary

Threat: mirai Total URLs: 4 Active URLs: 4

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: mirai
let malicious_domains = dynamic(["112.254.156.154", "41.216.189.92", "110.37.127.135"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["112.254.156.154", "41.216.189.92", "110.37.127.135"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios for the URLhaus: mirai Malicious URLs detection rule in an enterprise environment, along with suggested filters or exclusions:

• Automated Firmware Update Scans by Network Management Systems

  • Scenario: Enterprise network appliances (e.g., Cisco Meraki, Aruba Central, or FortiGate) periodically poll public vulnerability databases and firmware repositories to check for updates. These systems often scan known IoT vendor domains that host Mirai-related binaries or configuration files, triggering the rule even though the traffic is part of a scheduled maintenance window rather than an active infection.
  • Filter/Exclusion: Create an exclusion based on the Source IP (whitelist the specific IPs of network management appliances) and restrict the alert to non-business hours if the scan occurs during off-peak times, or exclude specific destination domains known to be trusted firmware repositories (e.g., *.cisco.com, *.fortinet.net).

• Endpoint Protection Signature Synchronization

  • Scenario: Endpoint Detection and Response (EDR) agents such as CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint regularly connect to their cloud management consoles to download the latest threat intelligence feeds. These feeds often include signatures and URL lists specifically targeting IoT threats like Mirai, causing the EDR agent’s outbound connection to match the “mirai” tag in the URLhaus feed despite being a legitimate update process.
  • Filter/Exclusion: Exclude traffic originating from specific Process Names associated with the EDR service (e.g., C:\Program Files\CrowdStrike\csfalcon.exe or MsMpEng.exe) and filter by the destination port typically used for management updates (often 443 to specific CDN ranges).

• IT Asset Discovery and Vulnerability Scanning Jobs

  • **Scenario