URLhaus: mirai Malicious URLs

Hunt Hypothesis

This detection identifies network traffic accessing known Mirai botnet command-and-control or infection URLs to uncover potential IoT device compromises within the environment. Proactively hunting for these specific indicators in Azure Sentinel is critical because Mirai infections can rapidly propagate across connected devices, leading to large-scale DDoS attacks and unauthorized lateral movement before traditional alerts trigger.

IOC Summary

Threat: mirai Total URLs: 3 Active URLs: 1

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: mirai
let malicious_domains = dynamic(["222.185.199.120"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["222.185.199.120"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios and corresponding filters/exclusions for the URLhaus: mirai Malicious URLs detection rule in an enterprise environment:

• IoT Device Firmware Updates via Vendor Portals

  • Scenario: Managed IoT devices (e.g., Cisco IP Phones, Ubiquiti Access Points) automatically query vendor update servers to check for firmware patches. These servers often host files with signatures similar to Mirai botnet payloads or reside on domains that URLhaus has previously flagged due to shared infrastructure.
  • Filter/Exclusion: Create a whitelist exclusion for specific internal IoT subnets (e.g., 10.50.x.x) and known vendor update domains (e.g., *.cisco.com, *.ubnt.com). Additionally, exclude traffic from the “IoT Management” group in your EDR/SIEM if the destination port is restricted to standard HTTPS (443) or HTTP (80).

• Scheduled Security Scanner Traffic

  • Scenario: Enterprise vulnerability scanners like Tenable Nessus, Qualys, or Rapid7 InsightVM perform daily scheduled jobs that probe external URLs. These tools often download test payloads or reference libraries from public repositories that may contain Mirai-related signatures, triggering the rule during their routine “heartbeat” checks.
  • Filter/Exclusion: Implement a time-based exclusion for the specific Service Accounts used by these scanners (e.g., svc-nessus-scan or svc-qualys-agent) during their defined maintenance windows (e.g., 02:00–04:00 UTC). Alternatively, filter out URLs containing known scanner query parameters like /api/v1/scan in the URL path.

• Cloud Backup and Synchronization Services

  • Scenario: Automated backup agents such as Veeam, Rubrik, or