URLhaus: mirai Malicious URLs

Hunt Hypothesis

This detection rule identifies Mirai botnet activity by flagging traffic to known malicious URLs that exploit IoT device vulnerabilities to establish command-and-control channels for potential DDoS campaigns. Proactively hunting for these indicators in Azure Sentinel is critical to rapidly isolate compromised endpoints before they are recruited into a larger botnet capable of disrupting network availability.

IOC Summary

Threat: mirai Total URLs: 11 Active URLs: 11

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: mirai
let malicious_domains = dynamic(["lol.exodustrala.dpdns.org", "170.205.31.25", "36.48.41.248", "120.28.139.212", "36.69.80.149", "125.43.0.79", "117.24.218.134", "179.108.89.220", "180.252.209.203"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["lol.exodustrala.dpdns.org", "170.205.31.25", "36.48.41.248", "120.28.139.212", "36.69.80.149", "125.43.0.79", "117.24.218.134", "179.108.89.220", "180.252.209.203"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: Mirai Malicious URLs detection rule within an enterprise environment, along with suggested filters and exclusions:

• IoT Firmware Update Scans by Network Management Tools

  • Scenario: Enterprise network management tools like SolarWinds NCM or Cisco DNA Center automatically scan the firmware versions of connected IoT devices (e.g., IP cameras, smart thermostats) against known vulnerability databases. These tools often query URLs hosted on public repositories that share similar domain structures or hash signatures with Mirai distribution points, triggering a false alert when the tool simply fetches update metadata rather than downloading malware.
  • Filter/Exclusion: Create an exclusion rule based on the Source Hostname (e.g., solarwinds-ncm-scan) and Destination Port 80/443. Additionally, filter out traffic where the HTTP User-Agent string contains specific identifiers for known management tools (e.g., User-Agent: SolarWinds-Network-Manager).

• Scheduled Cloud Backup Jobs Accessing Public CDN Nodes

  • Scenario: Automated backup agents such as Veeam Backup & Replication or Rubrik periodically connect to public Content Delivery Networks (CDNs) like Cloudflare or Akamai to retrieve configuration manifests. If the Mirai rule relies on URL reputation scores that flag specific CDN subdomains used for software distribution, legitimate backup traffic fetching these manifests may be flagged as malicious Mirai URLs.
  • Filter/Exclusion: Implement a filter excluding traffic from Backup Service Accounts (e.g., svc-veeam-backup) accessing known trusted CDNs. Use a whitelist of specific Destination IP Ranges associated with the enterprise’s primary CDN provider to bypass the URL reputation check for these scheduled jobs.