URLhaus: mirai Malicious URLs

Hunt Hypothesis

This rule detects adversary behavior involving connections to known Mirai botnet command-and-control infrastructure by identifying traffic directed at a curated list of 17 malicious URLs from URLhaus. A SOC team should proactively hunt for this activity in Azure Sentinel to rapidly identify and isolate compromised IoT devices before they are leveraged in large-scale distributed denial-of-service (DDoS) attacks or lateral movement campaigns.

IOC Summary

Threat: mirai Total URLs: 17 Active URLs: 17

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: mirai
let malicious_domains = dynamic(["58.23.201.90", "222.219.74.184", "182.120.45.147", "60.177.161.14", "190.109.227.76", "117.95.220.54", "45.177.33.164", "204.116.34.34", "123.14.212.48", "182.120.35.98", "106.110.208.117", "180.243.251.152", "79.106.74.167", "124.92.89.190", "110.85.99.100"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["58.23.201.90", "222.219.74.184", "182.120.45.147", "60.177.161.14", "190.109.227.76", "117.95.220.54", "45.177.33.164", "204.116.34.34", "123.14.212.48", "182.120.35.98", "106.110.208.117", "180.243.251.152", "79.106.74.167", "124.92.89.190", "110.85.99.100"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios for the URLhaus: Mirai Malicious URLs detection rule, along with recommended filters and exclusions tailored for an enterprise environment:

• IoT Device Firmware Updates via Manufacturer Gateways

  • Scenario: Enterprise IoT devices (e.g., Cisco IP Phones, Ubiquiti Access Points) frequently initiate outbound HTTPS connections to manufacturer update servers (such as firmware.cisco.com or update.ubnt.com) that may host Mirai-tagged URLs due to shared infrastructure or CDN overlaps.
  • Filter/Exclusion: Create an exclusion rule based on the destination IP ranges of known vendor update domains and restrict the detection scope to exclude traffic originating from specific IoT VLANs (e.g., VLAN-IoT-01) or device categories labeled “Network Infrastructure.”

• Scheduled Security Scanner Probes

  • Scenario: Internal vulnerability management tools like Qualys Cloud Agent, Tenable Nessus, or Rapid7 InsightVM perform scheduled daily scans that include URL reputation checks. These scanners often query the same Mirai-tagged endpoints to validate their own threat intelligence feeds, triggering a hit on every scan cycle.
  • Filter/Exclusion: Exclude traffic generated by specific service accounts (e.g., svc-qualys-scan) or filter out events where the source application is identified as “Qualys” or “Tenable,” ensuring only human-initiated browser sessions trigger the alert for these specific URLs.

• Automated CI/CD Pipeline Artifact Downloads

  • Scenario: DevOps pipelines running on platforms like Jenkins, GitLab Runner, or Azure DevOps Agents often download build artifacts, dependencies, or security reports from public repositories (e.g., GitHub Actions runners pulling from github.com or maven.org). If the pipeline fetches a resource