URLhaus: mirai Malicious URLs

Hunt Hypothesis

This detection identifies network traffic communicating with known Mirai botnet command-and-control URLs to uncover potential IoT device infections and lateral movement. Proactive hunting in Azure Sentinel is critical because Mirai variants can rapidly compromise unpatched devices, leading to large-scale DDoS attacks or data exfiltration before traditional signature-based alerts trigger.

IOC Summary

Threat: mirai Total URLs: 2 Active URLs: 2

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: mirai
let malicious_domains = dynamic(["222.243.95.50"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["222.243.95.50"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 5 specific false positive scenarios for the URLhaus: mirai Malicious URLs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Automated Firmware Updates via Cloud Repositories

  • Context: Enterprise IoT devices (e.g., Cisco Meraki APs, Ubiquiti UniFi controllers) or network appliances automatically query public firmware repositories hosted on domains that share IP ranges with known Mirai-infected networks. These legitimate update requests often hit URLs flagged by URLhaus due to shared infrastructure.
  • Suggested Filter/Exclusion: Create an exclusion rule for traffic originating from specific internal IoT subnets (e.g., 10.50.x.x) destined for trusted vendor domains (e.g., *.cisco.com, *.ubnt.com). Alternatively, filter out URLs where the HTTP User-Agent string contains keywords like “FirmwareUpdate” or “AutoUpgrade”.

• Scenario: Scheduled Security Scans by Internal Vulnerability Management Tools

  • Context: Tools such as Tenable Nessus, Qualys, or Rapid7 InsightVM perform scheduled external scans. During these scans, the tools may probe public-facing assets that are currently hosting Mirai-related signatures in their URL databases, triggering alerts when the scanner itself accesses a flagged resource to verify certificate chains or download scan definitions.
  • Suggested Filter/Exclusion: Exclude traffic where the source IP belongs to the dedicated vulnerability management server pool (e.g., 192.168.10.50-60). Additionally, filter out events where the HTTP method is HEAD or GET and the response code is 200 OK, as these often represent successful discovery rather than malicious interaction.

• Scenario: Cloud Backup Agents Accessing Public Storage Buckets

  • **Context