URLhaus: mirai Malicious URLs

Hunt Hypothesis

This detection identifies adversary behavior where IoT devices or network hosts attempt to access known Mirai botnet command-and-control URLs, signaling potential initial infection or active participation in a distributed denial-of-service campaign. A SOC team should proactively hunt for these indicators within Azure Sentinel to rapidly isolate compromised endpoints before they are leveraged as part of a larger botnet infrastructure capable of launching widespread network attacks.

IOC Summary

Threat: mirai Total URLs: 16 Active URLs: 16

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: mirai
let malicious_domains = dynamic(["115.206.180.117", "103.125.31.101", "36.70.227.223", "110.186.230.101", "103.44.137.13", "120.28.194.30", "113.221.76.194", "120.28.215.129", "124.6.167.121", "113.235.59.91", "119.176.53.238", "31.129.0.57", "175.30.114.108", "125.166.48.235", "113.221.36.67"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["115.206.180.117", "103.125.31.101", "36.70.227.223", "110.186.230.101", "103.44.137.13", "120.28.194.30", "113.221.76.194", "120.28.215.129", "124.6.167.121", "113.235.59.91", "119.176.53.238", "31.129.0.57", "175.30.114.108", "125.166.48.235", "113.221.36.67"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the URLhaus: Mirai Malicious URLs detection rule in an enterprise environment:

• IoT Device Firmware Updates via Vendor Portals

  • Scenario: Enterprise-managed IoT devices (e.g., Cisco Meraki cameras, Aruba switches) automatically query vendor update servers to check for firmware patches. These queries often hit endpoints that share URL patterns or IP ranges with known Mirai botnet command-and-control (C2) infrastructure, triggering the rule despite being legitimate maintenance traffic.
  • Filter/Exclusion: Create a whitelist exclusion based on specific vendor FQDNs (e.g., *.cisco.com, *.arubanetworks.com) or restrict the detection to exclude traffic originating from dedicated IoT VLAN subnets where these devices reside.

• Scheduled Vulnerability Scanning Jobs

  • Scenario: Automated security tools like Tenable Nessus, Qualys, or Rapid7 InsightVM run nightly scans against internal and external assets. During the scan, these engines probe a wide array of URLs to verify certificate validity and reachability, including those flagged by URLhaus as Mirai-related, resulting in false alerts for every scanned host.
  • Filter/Exclusion: Exclude traffic generated by known scanner service accounts (e.g., svc-nessus, qualys-agent) or filter out URLs where the HTTP User-Agent string contains specific identifiers like “Nessus”, “Qualys”, or “Rapid7”.

• Cloud Backup and Synchronization Agents

  • Scenario: Enterprise backup solutions such as Veeam, Rubrik, or Acronis Cyber Protect perform scheduled synchronization tasks. These agents often communicate with cloud storage gateways that utilize shared CDN networks (like Cloudflare or AWS CloudFront) which may host Mirai-tagged URLs, causing