URLhaus: mirai Malicious URLs

Hunt Hypothesis

This rule identifies network traffic or web proxy logs containing known malicious URLs associated with the Mirai botnet, indicating potential active compromise or lateral movement attempts by IoT-focused malware. Proactively hunting for these indicators in Azure Sentinel is critical because Mirai often propagates rapidly across unpatched devices, allowing the SOC to isolate affected assets before the botnet can be leveraged for large-scale DDoS attacks or further payload delivery.

IOC Summary

Threat: mirai Total URLs: 17 Active URLs: 17

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: mirai
let malicious_domains = dynamic(["112.198.130.112", "216.249.4.20", "170.84.133.234", "112.198.195.68", "171.36.9.93", "58.65.210.132", "181.174.231.21", "130.12.209.153", "120.28.193.113", "117.26.113.132", "87.13.96.192", "123.135.74.52", "180.191.228.88", "124.235.175.136", "105.224.38.185"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["112.198.130.112", "216.249.4.20", "170.84.133.234", "112.198.195.68", "171.36.9.93", "58.65.210.132", "181.174.231.21", "130.12.209.153", "120.28.193.113", "117.26.113.132", "87.13.96.192", "123.135.74.52", "180.191.228.88", "124.235.175.136", "105.224.38.185"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• IoT Device Firmware Updates via Internal Proxy: Legacy IoT devices (e.g., IP cameras, smart thermostats) configured with hardcoded or cached URLs from older firmware versions may attempt to fetch update manifests or configuration files that coincidentally match known Mirai URL patterns, especially if the proxy allows pass-through for specific internal subdomains.

  • Filter/Exclusion: Exclude traffic where the source IP belongs to the 10.20.0.0/24 (IoT VLAN) and the User-Agent header contains curl/7.68.0 or wget/1.20.1, provided the destination port is 443 and the response code is 200.

• Web Scraping or Monitoring Tools Caching Malicious URLs: Enterprise monitoring tools like Nagios, Zabbix, or custom Python-based health check scripts may periodically validate external endpoints or cache HTTP responses. If a Mirai URL was previously observed in a public threat feed or shared via a Confluence wiki page that the tool scrapes, it may appear in logs as a legitimate “check” rather than an active infection.

  • Filter/Exclusion: Exclude events where the source process is python3 or java and the command line arguments contain --health-check or --validate-url, and the source host is in the monitoring-cluster Kubernetes namespace.

• Browser History or Bookmark Synchronization: End-user browsers (e.g., Chrome, Edge) with synchronized history or bookmarks may load cached URLs during startup or when a user clicks a stale bookmark. If an analyst or developer previously tested a Mirai URL in a sandboxed environment and saved it to a shared bookmark set, it may reappear in network logs during routine browser sync operations.

  • Filter/Exclusion: Exclude traffic where the User-Agent contains `Chrome