URLhaus: mirai Malicious URLs

Hunt Hypothesis

This detection identifies web traffic accessing known Mirai botnet command-and-control or infection URLs flagged by URLhaus to prevent IoT device compromise and lateral movement within the network. The SOC team should proactively hunt for these indicators in Azure Sentinel to rapidly isolate infected endpoints before they propagate the Mirai worm across critical infrastructure.

IOC Summary

Threat: mirai Total URLs: 5 Active URLs: 4

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: mirai
let malicious_domains = dynamic(["196.189.197.131", "112.198.138.178", "115.203.138.135"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["196.189.197.131", "112.198.138.178", "115.203.138.135"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the URLhaus: mirai Malicious URLs detection rule in an enterprise environment:

• IoT Firmware Update Scans: Enterprise IoT management platforms (e.g., Cisco Meraki, Ubiquiti UniFi, or Bosch Security Systems) frequently query external vendor repositories to check for firmware updates. These requests often hit generic update endpoints that share URL patterns with known Mirai botnet command-and-control domains, triggering the rule during scheduled nightly maintenance windows.

  • Suggested Filter: Exclude traffic originating from specific IoT management subnets (e.g., 10.50.x.x) or filter by destination ports commonly used for firmware checks (e.g., 80, 443, 8080) when the source user agent contains keywords like “FirmwareUpdate” or the device type is identified as “IoT Gateway.”

• Automated Security Scanning Tools: Internal vulnerability scanners such as Tenable Nessus, Qualys, or Rapid7 InsightVM perform continuous external asset discovery. These tools often probe public-facing URLs to verify reachability and security posture, inadvertently hitting the specific Mirai-tagged URLs included in their standard “common internet” baseline library.

  • Suggested Filter: Create an exclusion for source IP ranges dedicated to security scanning appliances (e.g., 192.168.200.x) or filter events where the HTTP User-Agent string matches known scanner signatures (e.g., containing “Nessus”, “Qualys”, or “InsightVM”).

• Scheduled Cloud Backup and Sync Jobs: Enterprise cloud synchronization services like Microsoft OneDrive for Business, Box, or Dropbox may utilize shared CDN endpoints that overlap with Mirai infrastructure. During scheduled backup windows (e.g., 2:00 AM daily), these services initiate