URLhaus: mirai Malicious URLs

Hunt Hypothesis

This hunt targets the presence of known Mirai botnet command-and-control URLs to identify hosts that may have been compromised by this prevalent IoT and Linux malware. Proactively hunting for these indicators in Azure Sentinel allows the SOC to detect lateral movement or initial access vectors before the botnet can propagate across the network or execute its payload.

IOC Summary

Threat: mirai Total URLs: 4 Active URLs: 3

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: mirai
let malicious_domains = dynamic(["42.228.39.193", "222.127.55.224"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["42.228.39.193", "222.127.55.224"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• IoT Device Firmware Updates: Legacy IoT devices (e.g., IP cameras, smart plugs) running outdated firmware may automatically poll specific update endpoints or C2 servers that have been historically associated with Mirai botnet infrastructure.
  • Filter/Exclusion: Exclude source IPs belonging to the IoT VLAN or specific device asset tags (e.g., asset_tag:iot_camera) from this detection if the destination URL matches a known firmware update domain.
• Legacy Application Health Checks: Older enterprise applications (e.g., specific SCADA HMI software or legacy web portals) might use hardcoded URLs for license validation or telemetry that coincidentally match one of the four Mirai-tagged URLs due to shared hosting or historical IP reuse.
  • Filter/Exclusion: Exclude processes from known legacy application binaries (e.g., process_name:scada_hmi.exe or process_name:legacy_portal_service.exe) when the user agent string indicates a specific legacy version.
• Scheduled Backup or Sync Jobs: Scheduled tasks (e.g., Task Scheduler on Windows or cron on Linux) for backup agents or file sync tools (like rsync or specialized backup clients) might connect to specific endpoints that are also used by Mirai variants for configuration retrieval, especially if the backup server IP has been compromised or reused.
  • Filter/Exclusion: Exclude connections initiated by specific service accounts (e.g., user:svc_backup) or processes associated with backup agents (e.g., process_name:backup_agent.exe) when the destination port is 80/443 and the URL matches the specific Mirai list.
• Web Browser Caching or Redirects: Users browsing internal wikis or documentation sites that embed external links or iframes pointing to the Mirai URLs for demonstration purposes (e.g., security training pages) may trigger the rule when the browser fetches these resources