URLhaus: mirai Malicious URLs

Hunt Hypothesis

This hypothesis targets the presence of known Mirai botnet command-and-control (C2) URLs, indicating that an adversary is actively managing compromised IoT or embedded devices to facilitate botnet operations. Proactively hunting for these specific indicators in Azure Sentinel allows the SOC to identify lateral movement or persistent footholds within the network before the botnet can be leveraged for large-scale DDoS attacks or further exploitation.

IOC Summary

Threat: mirai Total URLs: 5 Active URLs: 5

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: mirai
let malicious_domains = dynamic(["196.190.105.170", "82.144.86.37", "36.64.184.26", "207.188.90.227"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["196.190.105.170", "82.144.86.37", "36.64.184.26", "207.188.90.227"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Legacy IoT Device Firmware Updates: Many unpatched IoT devices (e.g., IP cameras, smart thermostats) running older firmware versions may still reference Mirai-related update endpoints or C2 servers during their periodic self-update cycles.
  • Filter/Exclusion: Exclude source IPs belonging to the IoT VLAN or specific device MAC address ranges from the URLhaus Mirai URL match, or whitelist known firmware update domains if they overlap with the malicious URL patterns.
• Security Testing and Penetration Exercises: During authorized penetration tests or red team engagements, analysts often deploy Mirai botnet emulators or use known Mirai C2 URLs to validate detection coverage and alerting pipelines.
  • Filter/Exclusion: Correlate with ticketing system tags (e.g., Jira/ServiceNow “PenTest” or “RedTeam” labels) or exclude sessions originating from specific test subnets (e.g., 10.200.0.0/24) during scheduled maintenance windows.
• Web Scraping and Threat Intelligence Feeds: Automated threat intelligence platforms or web scraping agents may fetch URLhaus data or mirror malicious URL lists for local analysis, causing internal web proxies or EDR agents to log connections to these known malicious URLs.
  • Filter/Exclusion: Exclude user agents or service accounts associated with SIEM/Threat Intel collectors (e.g., TIP-Collector, MISP-Sync) or filter out traffic where the destination port is 80/443 and the source is the designated Threat Intel server IP.
• Backup and Disaster Recovery Verification: Some backup verification tools or DR testing scripts may use known malicious URLs as “canary” endpoints to test network egress policies or DNS resolution capabilities in isolated test environments.
  • Filter/Exclusion: Exclude traffic from the DR test subnet or specific service accounts