URLhaus: mirai Malicious URLs

Hunt Hypothesis

This detection rule identifies network traffic connecting to six specific URLs known to host Mirai botnet malware, which adversaries leverage to compromise IoT devices and establish command-and-control channels. The SOC team should proactively hunt for these indicators in Azure Sentinel to rapidly isolate infected endpoints before they are recruited into a larger botnet capable of launching distributed denial-of-service attacks or lateral movement campaigns.

IOC Summary

Threat: mirai Total URLs: 6 Active URLs: 5

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: mirai
let malicious_domains = dynamic(["105.224.42.87", "123.12.168.110", "31.56.209.153", "120.28.220.18"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["105.224.42.87", "123.12.168.110", "31.56.209.153", "120.28.220.18"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios and corresponding exclusion strategies for the URLhaus: mirai Malicious URLs detection rule in an enterprise environment:

• IoT Device Firmware Updates: Enterprise-managed IoT devices (e.g., Hikvision cameras, Axis network appliances, or Cisco Meraki access points) often connect to manufacturer update servers that host Mirai-related binaries. When these devices perform scheduled nightly firmware checks, they may trigger the rule if the vendor’s CDN IP is flagged as a Mirai distribution point.

  • Exclusion Strategy: Create an allowlist for known IoT management subnets (e.g., 10.50.x.x) or specific device MAC address ranges in the SIEM logic to exclude traffic originating from these segments during maintenance windows (e.g., 02:00–04:00 UTC).

• Automated Security Scanning Tools: Internal vulnerability scanners like Tenable Nessus, Qualys, or Rapid7 InsightVM frequently probe external endpoints to assess IoT security posture. These tools often simulate Mirai botnet traffic patterns by querying known Mirai-infected hosts or scanning public Mirai repositories, generating legitimate hits that mimic malicious activity.

  • Exclusion Strategy: Configure the detection rule to exclude source IPs belonging to the internal security tool fleet (e.g., 192.168.100.5 for Nessus) and filter out events where the user agent string contains specific scanner identifiers like “Nessus-Scanner” or “QualysGuard”.

• DevOps CI/CD Pipeline Artifacts: In environments utilizing containerized IoT simulations, Jenkins or GitLab CI pipelines often pull dependencies from public repositories that include Mirai test vectors. During the build phase, automated agents download these artifacts to validate network segmentation rules, inadvertently triggering the URLhaus alert on legitimate build servers.