URLhaus: mirai Malicious URLs

Hunt Hypothesis

This hypothesis targets the presence of known Mirai botnet command-and-control (C2) infrastructure, indicating that an adversary is actively managing compromised IoT or embedded devices to facilitate distributed denial-of-service (DDoS) attacks or lateral movement. Proactively hunting for these specific URLs in Azure Sentinel allows the SOC team to identify silent, low-and-slow beaconing traffic that traditional perimeter defenses may miss, thereby reducing the dwell time of this high-severity threat within the network.

IOC Summary

Threat: mirai Total URLs: 3 Active URLs: 3

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: mirai
let malicious_domains = dynamic(["222.127.53.189", "196.190.1.39", "45.183.184.74"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["222.127.53.189", "196.190.1.39", "45.183.184.74"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Scenario: A network operations center (NOC) engineer is performing a manual connectivity test on a newly deployed IoT gateway that uses the Mirai firmware variant, accessing the device’s web interface via a known IP address mapped to one of the URLhaus entries during a maintenance window.

  • Filter/Exclusion: Exclude alerts where the source IP belongs to the NOC management VLAN (e.g., 10.20.0.0/24) and the user agent string contains “curl” or “wget” (indicating script-based testing rather than browser interaction), or exclude if the HTTP method is HEAD/GET with a 200/404 status code and no subsequent POST/PUT activity.

• Scenario: A security team is running a passive vulnerability scan using a tool like Qualys or Tenable that includes a custom plugin to verify the presence of Mirai-related endpoints on internet-facing devices, resulting in automated HTTP requests to the specific malicious URLs.

  • Filter/Exclusion: Exclude alerts where the source IP is associated with the vulnerability scanner service account (e.g., svc-vuln-scan) or if the User-Agent header matches known scanner signatures (e.g., “Qualys”, “Tenable”, “Nessus”), and the request frequency is consistent with a scan interval (e.g., < 5 requests per minute).

• Scenario: A developer is debugging a legacy IoT application in a staging environment that intentionally replicates the Mirai botnet’s C2 communication pattern to validate the new intrusion detection system’s coverage, using a local proxy that forwards requests to the known URLhaus entries.

  • Filter/Exclusion: Exclude alerts where the source IP is within the staging network range (e.g., 172.16.50.0/24) and the destination URL is accessed via an