URLhaus: mirai Malicious URLs

Hunt Hypothesis

This hunt detects adversary behavior where IoT devices or network endpoints communicate with known Mirai botnet command-and-control servers via specific malicious URLs identified by URLhaus. The SOC team should proactively hunt for these indicators in Azure Sentinel to identify early-stage infections and prevent lateral movement before the botnet can orchestrate large-scale DDoS attacks against critical infrastructure.

IOC Summary

Threat: mirai Total URLs: 6 Active URLs: 5

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: mirai
let malicious_domains = dynamic(["82.86.65.140", "112.252.222.187", "183.92.205.45"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["82.86.65.140", "112.252.222.187", "183.92.205.45"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 5 specific false positive scenarios for the URLhaus: Mirai Malicious URLs detection rule in an enterprise environment, along with suggested filters or exclusions:

• Automated Firmware Update Scans by Network Management Tools

  • Scenario: Enterprise network management platforms (e.g., SolarWinds NPM, ManageEngine OpManager, or Cisco DNA Center) periodically scan connected IoT devices and routers to check for firmware updates. These tools often query public update repositories that host Mirai-related binaries or configuration files, triggering the rule when the tool’s service account accesses these known “Mirai” endpoints.
  • Filter/Exclusion: Exclude traffic originating from specific Service Accounts (e.g., svc-solarwinds, cisco-dna) and destination ports associated with management protocols (HTTP/HTTPS) on the network management subnet range.

• Scheduled Vulnerability Scans by Security Appliances

  • Scenario: Scheduled vulnerability assessments performed by tools like Tenable Nessus, Qualys, or Rapid7 InsightVM often include a specific module for IoT device security. During these scans, the scanner actively probes external URLs known to host Mirai signatures to validate the threat intelligence feed, generating legitimate hits on the “Mirai” tag even though no actual infection is occurring on the endpoint being scanned.
  • Filter/Exclusion: Create a whitelist for the IP addresses of the Vulnerability Scanners and exclude URLs that match the specific User-Agent strings used by these scanners (e.g., containing “Tenable.Nessus” or “QualysAgent”).

• IT Admin Manual Investigation of IoT Device Health

  • Scenario: Network administrators manually investigating a cluster of IP cameras or smart thermostats may access vendor support portals or firmware download pages. For instance, an admin using **Microsoft Edge