URLhaus: mirai Malicious URLs

Hunt Hypothesis

This detection identifies potential Mirai botnet infections by monitoring network traffic against a curated set of three known malicious URLs associated with IoT device compromise. A proactive hunt is essential in Azure Sentinel to rapidly isolate infected endpoints before adversaries leverage these devices for large-scale DDoS attacks or lateral movement within the enterprise network.

IOC Summary

Threat: mirai Total URLs: 3 Active URLs: 3

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: mirai
let malicious_domains = dynamic(["36.48.28.98", "115.58.177.86"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["36.48.28.98", "115.58.177.86"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: mirai Malicious URLs detection rule, along with targeted filters and exclusions suitable for an enterprise environment:

• Scenario: Automated Firmware Update Scans by IoT Management Platforms

  • Context: Enterprise IoT management tools (e.g., Cisco Meraki, Ubiquiti UniFi Network, or IBM Maximo) periodically query public vulnerability databases to check for firmware updates on connected devices. These queries often hit URLs hosted on the same infrastructure as Mirai botnet command-and-control (C2) servers, triggering a match despite being benign administrative traffic.
  • Filter/Exclusion: Exclude source IP ranges belonging to internal IoT management gateways and specific destination domains known for hosting firmware repositories (e.g., *.meraki.com, *.ubnt.com). Additionally, filter out HTTP GET requests where the User-Agent string contains keywords like “FirmwareUpdate” or “DeviceManager”.

• Scenario: Scheduled Security Baseline Scans by Endpoint Protection Agents

  • Context: Enterprise endpoint protection suites (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint, or Trend Micro Apex One) perform scheduled daily or weekly outbound connectivity tests. These agents often probe a list of “trusted” external URLs to verify network reachability, which may include Mirai-tagged URLs used as global health check endpoints by the vendor itself.
  • Filter/Exclusion: Create an exclusion rule for traffic originating from the specific service accounts or host groups running these EDR agents (e.g., HostGroup: Endpoint_Scan_Orchestrator). Filter based on the process name of the scanning agent (e.g., C:\Program Files\CrowdStrike\csagent.exe) and exclude alerts where the HTTP method is GET with a status code of 200 OK.