URLhaus: mirai Malicious URLs

Hunt Hypothesis

This detection identifies network traffic accessing known Mirai botnet command-and-control or infection URLs to uncover potential IoT device compromise and lateral movement within the environment. Proactive hunting is essential in Azure Sentinel to rapidly isolate infected endpoints before they are leveraged for large-scale DDoS attacks or used as a foothold for broader network infiltration.

IOC Summary

Threat: mirai Total URLs: 3 Active URLs: 3

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: mirai
let malicious_domains = dynamic(["221.14.42.82", "110.37.90.59"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["221.14.42.82", "110.37.90.59"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios and their corresponding filters for the URLhaus: mirai Malicious URLs detection rule in an enterprise environment:

• IoT Device Firmware Updates via Scheduled Tasks

  • Scenario: Enterprise-managed IoT devices (e.g., Cisco IP cameras, Ubiquiti access points) often connect to manufacturer update servers on a daily schedule. These devices frequently download firmware or configuration files from domains that URLhaus may flag as Mirai-related due to shared infrastructure with known botnets, even though the traffic is legitimate maintenance traffic.
  • Filter/Exclusion: Create an exclusion list for specific IoT device subnets (e.g., 10.50.20.0/24) or whitelist the specific manufacturer update domains (e.g., *.cisco.com, *.ubnt.com) within the URLhaus detection logic to ignore traffic originating from these known asset groups during scheduled maintenance windows (e.g., 02:00–04:00 UTC).

• Security Scanner and Vulnerability Assessment Probes

  • Scenario: Internal vulnerability management tools like Tenable Nessus, Qualys, or Microsoft Defender for IoT actively scan network endpoints. During scans, these tools often query external threat intelligence feeds or download signature updates from repositories that host Mirai-related signatures. The scanner’s outbound traffic to these feeds can be misidentified as a compromised host communicating with a malicious Mirai URL.
  • Filter/Exclusion: Exclude the IP addresses of all internal security scanners and jump hosts (e.g., 192.168.10.5, 192.168.10.6) from the detection rule. Additionally, add a condition to ignore alerts where the destination URL contains known threat intelligence feed domains (e.g., *.urlhaus.abuse.ch,