URLhaus: mirai Malicious URLs

Hunt Hypothesis

This detection identifies adversary activity associated with Mirai botnet infections by monitoring network traffic against a curated list of ten known malicious URLs. Proactive hunting is essential in Azure Sentinel to rapidly isolate compromised IoT or edge devices before they are leveraged for large-scale DDoS attacks or lateral movement within the enterprise network.

IOC Summary

Threat: mirai Total URLs: 10 Active URLs: 10

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: mirai
let malicious_domains = dynamic(["222.142.73.193", "60.162.38.51", "193.163.187.73", "121.239.148.213", "222.137.147.215", "223.151.74.246", "196.190.105.170"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["222.142.73.193", "60.162.38.51", "193.163.187.73", "121.239.148.213", "222.137.147.215", "223.151.74.246", "196.190.105.170"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 5 specific false positive scenarios for the URLhaus: Mirai Malicious URLs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Automated Firmware Update Scans by Endpoint Protection Agents

  • Context: Enterprise endpoint protection suites (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint) frequently query known threat intelligence feeds to update their local malware definitions. These agents often scan URLs hosted on public infrastructure that may share IP ranges or domain structures with Mirai-infected IoT devices, triggering a match against the “mirai” tag even though the traffic is benign administrative scanning.
  • Filter/Exclusion: Exclude traffic originating from specific Endpoint Protection service accounts (e.g., svc-defender-updates) or filter out URLs containing known update paths like /api/v1/feed and /updates/metadata.xml.

• Scenario: Scheduled IoT Device Inventory Jobs via Network Monitoring Tools

  • Context: Network monitoring tools such as SolarWinds NPM or PRTG run scheduled jobs (e.g., every 4 hours) to ping and inventory IoT devices across the corporate network. Since Mirai is an IoT-focused malware, these tools often probe device management interfaces that return URLs structurally similar to those flagged by URLhaus, causing legitimate discovery traffic to be classified as malicious.
  • Filter/Exclusion: Create a rule exclusion for source IPs belonging to the “Network Monitoring” VLAN or subnets (e.g., 10.50.20.0/24) and exclude specific scheduled job user agents containing keywords like SolarWinds-Discovery or PRTG-Sensor.

• Scenario: Cloud Backup Agents Syncing with Public Object Storage

  • Context: Enterprise backup solutions (e.g., Veeam, Rubrik) utilize public object storage buckets for offsite