URLhaus: mirai Malicious URLs

Hunt Hypothesis

This detection identifies adversary behavior where internal assets communicate with known Mirai botnet command-and-control infrastructure via specific malicious URLs. Proactively hunting for these indicators in Azure Sentinel is critical to rapidly isolate compromised IoT or network devices before they participate in large-scale DDoS attacks or lateral movement campaigns.

IOC Summary

Threat: mirai Total URLs: 5 Active URLs: 5

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: mirai
let malicious_domains = dynamic(["110.83.135.231", "129.121.110.105", "196.189.9.27", "31.77.227.10"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["110.83.135.231", "129.121.110.105", "196.189.9.27", "31.77.227.10"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios for the URLhaus: Mirai Malicious URLs detection rule in an enterprise environment, along with targeted exclusion strategies:

• Scheduled Firmware Update Scans by Network Management Tools

  • Scenario: Enterprise network management platforms like SolarWinds NPM, ManageEngine OpManager, or Cisco Prime Infrastructure run daily scheduled jobs to scan connected IoT devices (IP cameras, VoIP phones, routers) for firmware versions. These tools often query public vulnerability databases or vendor update servers that host Mirai-related signatures or test endpoints, triggering the rule even though no actual malware infection is present on the endpoint itself.
  • Filter/Exclusion: Create a whitelist exception based on the internal IP addresses of the management server (e.g., 10.20.5.4) and restrict the alert to only trigger when the destination port is not standard web traffic (80/443) or if the user agent string contains specific tool identifiers like “SolarWinds-Scanner” or “ManageEngine-Agent”.

• Automated Vulnerability Assessment by Security Scanners

  • Scenario: Automated vulnerability scanners such as Tenable Nessus, Qualys VMDR, or Rapid7 InsightVM periodically probe external assets to check for known Mirai botnet vulnerabilities. During these scans, the scanner actively resolves and connects to URLhaus-listed test domains to validate certificate chains and response times, generating traffic that mimics a malicious connection attempt from an internal host.
  • Filter/Exclusion: Exclude traffic originating from the dedicated vulnerability scanning subnet (e.g., 192.168.50.0/24) or filter by process name if endpoint detection is available, specifically excluding processes named Tenable Nessus Agent, Qualys Cloud Agent, or Rapid7 Scanner.