URLhaus: mirai Malicious URLs

Hunt Hypothesis

This detection identifies Mirai botnet activity where adversaries exploit IoT devices with default credentials to establish command-and-control channels via malicious URLs. Proactive hunting in Azure Sentinel is critical because Mirai’s rapid propagation through unsecured network perimeters can quickly escalate into large-scale DDoS attacks or lateral movement threats that require immediate containment.

IOC Summary

Threat: mirai Total URLs: 12 Active URLs: 12

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: mirai
let malicious_domains = dynamic(["182.241.136.218", "124.234.246.166", "114.226.31.25", "114.227.224.253", "61.243.238.134", "182.244.41.109", "196.189.3.1", "123.97.30.141"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["182.241.136.218", "124.234.246.166", "114.226.31.25", "114.227.224.253", "61.243.238.134", "182.244.41.109", "196.189.3.1", "123.97.30.141"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 5 specific false positive scenarios for the URLhaus: mirai Malicious URLs detection rule, tailored for a legitimate enterprise environment involving IoT and network scanning activities:

• IoT Device Firmware Update Checks

  • Scenario: Legitimate IoT devices (e.g., Cisco IP Cameras, Ubiquiti Access Points) periodically query manufacturer update servers to check for firmware patches. These queries often hit well-known URLs that Mirai scans also target due to shared port usage or default configuration endpoints.
  • Filter/Exclusion: Create an exclusion list based on the specific hostname of the vendor’s update server (e.g., *.cisco.com, *.ubnt.com) and restrict the rule trigger to only apply when the User-Agent string does not match known device firmware agents.

• Scheduled Network Vulnerability Scans

  • Scenario: Enterprise security teams run scheduled vulnerability assessments using tools like Tenable Nessus, Qualys, or Nmap. These scanners actively probe IoT subnets to identify devices with default credentials, mimicking the exact scanning behavior of Mirai malware.
  • Filter/Exclusion: Exclude traffic originating from specific IP ranges assigned to internal security appliances (e.g., 10.50.20.0/24 for Nessus servers) or filter out alerts where the source port is a standard scanner ephemeral range during defined maintenance windows (e.g., 02:00–04:00 UTC).

• Default Credential Discovery by IT Automation Scripts

  • Scenario: Automated IT management scripts using tools like Ansible, PowerShell, or Python-based custom agents run nightly jobs to inventory IoT assets and verify default login credentials. These scripts generate HTTP/HTTPS requests that look identical to Mirai’s initial reconnaissance phase.
  • Filter/Exclusion: