URLhaus: mirai Malicious URLs

Hunt Hypothesis

This detection identifies potential Mirai botnet infections by flagging network traffic communicating with known malicious URLs associated with IoT device compromise. Proactively hunting for these indicators in Azure Sentinel is critical to rapidly isolate infected endpoints and prevent lateral movement or large-scale DDoS attacks before they impact the broader infrastructure.

IOC Summary

Threat: mirai Total URLs: 4 Active URLs: 4

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: mirai
let malicious_domains = dynamic(["105.224.251.74", "105.184.94.186", "182.119.63.53", "103.80.57.126"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["105.224.251.74", "105.184.94.186", "182.119.63.53", "103.80.57.126"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

False Positive Scenarios for “URLhaus: mirai Malicious URLs” Rule

• Scenario: Automated Firmware Update Checks by IoT Management Platforms

  • Context: Enterprise IoT management suites like Cisco Meraki Dashboard, Ubiquiti UniFi Controller, or ManageEngine Device Insight frequently poll vendor update servers to check for firmware patches. These vendors often host update manifests on domains that share IP ranges or URL structures with known Mirai botnet command-and-control (C2) infrastructure, causing the rule to flag routine health checks as malicious traffic.
  • Suggested Filter: Create an exclusion based on the source application name (cisco-meraki-agent, unifi-controller) and the specific destination domain pattern (e.g., *.firmware-update.cisco.com), ensuring that only outbound HTTPS traffic from these specific service accounts is ignored.

• Scenario: Scheduled Vulnerability Scans by Security Appliances

  • Context: Network security tools such as Tenable Nessus, Qualys Cloud Agent, or Rapid7 InsightVM perform scheduled vulnerability assessments against internal and external assets. During these scans, the agents may probe public URLs known to be associated with Mirai signatures (often used as test vectors in the scanner’s signature database), triggering false alerts when the scanner itself initiates the connection rather than a user endpoint.
  • Suggested Filter: Exclude traffic originating from the specific IP ranges of the vulnerability management servers (e.g., 10.20.30.x for Tenable) and filter by the process name (tenable-nessus, qualys-cloud-agent) during the defined maintenance window hours (e.g., 02:00–04:00 UTC).

• Scenario: Cloud Backup and Synchronization Services

  • Context: Enterprise backup solutions like **Veeam Backup