URLhaus: mirai Malicious URLs

Hunt Hypothesis

This hunt targets the presence of known Mirai botnet command-and-control (C2) URLs to identify hosts that may be compromised or actively communicating with malicious infrastructure. Proactively hunting for these indicators in Azure Sentinel allows the SOC to detect early-stage botnet infections and lateral movement attempts before they escalate into large-scale DDoS attacks or data exfiltration events.

IOC Summary

Threat: mirai Total URLs: 17 Active URLs: 17

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: mirai
let malicious_domains = dynamic(["221.15.187.9", "112.198.195.68", "58.65.210.30", "210.208.110.172", "109.108.56.174", "210.208.111.2", "124.161.116.2", "210.208.104.156", "36.70.100.38", "79.106.231.174", "120.28.192.123", "164.163.25.240", "45.233.226.43", "157.66.146.183", "210.208.111.36"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["221.15.187.9", "112.198.195.68", "58.65.210.30", "210.208.110.172", "109.108.56.174", "210.208.111.2", "124.161.116.2", "210.208.104.156", "36.70.100.38", "79.106.231.174", "120.28.192.123", "164.163.25.240", "45.233.226.43", "157.66.146.183", "210.208.111.36"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• IoT Device Firmware Updates: Legacy IoT devices (e.g., IP cameras, smart thermostats, or industrial controllers) running older firmware versions may still reference known Mirai botnet command-and-control (C&C) URLs during their periodic firmware check-in or update cycles.

  • Filter/Exclusion: Exclude source IPs belonging to the IoT or OT VLAN subnets (e.g., 10.20.0.0/24) from this hunt if the device asset inventory confirms they are running legacy firmware versions prior to the security patch that removed these specific C2 endpoints.

• Legacy Application Health Checks: Older internal web applications or microservices that were deployed before the Mirai outbreak and have not been refactored may include hardcoded health-check or status-polling URLs that coincidentally match the known Mirai C2 domains (often due to shared hosting or historical DNS records).

  • Filter/Exclusion: Create a whitelist for specific application service accounts (e.g., svc-app-healthcheck) or exclude traffic originating from the Legacy-App cluster nodes if the application team confirms these URLs are used solely for internal liveness probes and not external data exfiltration.

• Scheduled Backup or Sync Jobs: Scheduled cron jobs or Windows Task Scheduler tasks on file servers or backup appliances may use curl or wget to ping specific external endpoints for license validation or sync status reporting, where the endpoint domain has since been compromised or reused by Mirai variants.

  • Filter/Exclusion: Exclude source processes named backup-agent, sync-service, or license-validator if the destination URL is part of a known set of vendor-specific endpoints, and verify that the user context is a non-interactive service account (e.g., svc-backup).

• Developer Testing Environments: Developers in staging or QA environments may intentionally spin up