URLhaus: mirai Malicious URLs

Hunt Hypothesis

This hunt targets the presence of known Mirai botnet command-and-control (C2) URLs to identify hosts potentially compromised by this IoT-focused malware. Proactively hunting for these indicators in Azure Sentinel is critical because Mirai often propagates via brute-force attacks on exposed services, allowing adversaries to establish persistent footholds that can be leveraged for lateral movement or distributed denial-of-service (DDoS) attacks.

This hunt targets the presence of known Mirai botnet command-and-control (C2) URLs to identify hosts potentially compromised by this IoT-focused malware. Proactively hunting for these indicators in Azure Sentinel is critical because Mirai often propagates via brute-force attacks on exposed services, allowing adversaries to establish persistent footholds that can be leveraged for lateral movement or distributed denial-of-service (DDoS) attacks.

IOC Summary

Threat: mirai Total URLs: 17 Active URLs: 1

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: mirai
let malicious_domains = dynamic(["176.65.139.139"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["176.65.139.139"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• IoT Device Firmware Update Verification: Network engineers or IoT administrators may manually browse to known Mirai-related URLs (e.g., http://185.154.195.211:8080/) to verify firmware integrity or check for specific error codes during a manual device onboarding process.

  • Filter/Exclusion: Exclude traffic from the IoT Management VLAN or specific admin workstations (e.g., IoT-Admin-01) where the user agent string contains IoT-Admin or the source IP is within the 10.50.0.0/24 range.

• Security Team Threat Hunting & Validation: SOC analysts or threat hunters may intentionally visit these URLs in a sandboxed environment or via a dedicated hunting browser to validate the detection logic, capture PCAPs, or confirm the URL’s current behavior before updating the blocklist.

  • Filter/Exclusion: Exclude sessions where the User-Agent string contains ThreatHunt or Sandbox-Browser, or restrict the rule to exclude traffic from the Security-Tools subnet (192.168.100.0/24).

• Legacy Application Health Checks: A legacy internal application (e.g., a custom device monitoring dashboard) might use one of these Mirai-tagged URLs as a “canary” endpoint to test outbound HTTP connectivity or DNS resolution before attempting to reach the primary API server.

  • Filter/Exclusion: Exclude requests where the Referer header is http://internal-monitoring.local/health or where the source application is identified as Legacy-Monitor-Svc in the process tree.

• CI/CD Pipeline Dependency Checks: A build server in a specific pipeline may fetch a known Mirai URL to test network egress rules or verify that a