URLhaus: mirai Malicious URLs

Hunt Hypothesis

This detection rule identifies outbound network traffic to six specific URLs known to host Mirai malware payloads, which adversaries leverage to establish command and control channels or deploy IoT botnet nodes. A SOC team should proactively hunt for these indicators within Azure Sentinel to rapidly isolate compromised devices before they propagate lateral movement or initiate large-scale distributed denial-of-service attacks across the organization’s infrastructure.

IOC Summary

Threat: mirai Total URLs: 6 Active URLs: 6

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: mirai
let malicious_domains = dynamic(["77.90.185.66"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["77.90.185.66"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 5 specific false positive scenarios for the URLhaus: mirai Malicious URLs detection rule, along with suggested filters and exclusions tailored for an enterprise environment:

• IoT Firmware Update Scans by Network Appliances

  • Scenario: Enterprise network appliances (e.g., Palo Alto Networks firewalls, Cisco Meraki switches) or IoT management platforms (like Ubiquiti UniFi) automatically query the Mirai-specific threat intelligence feed to update their internal signature databases. These devices often initiate outbound HTTPS connections to urlhaus.abuse.ch endpoints that match the rule’s URL patterns.
  • Filter/Exclusion: Create a whitelist exclusion based on the source IP ranges of known network infrastructure appliances (e.g., 10.20.50.x, 192.168.100.x) and specific process names such as panorama.exe or meraki-cloud-agent.

• Scheduled Security Posture Assessments by EDR Agents

  • Scenario: Endpoint Detection and Response (EDR) solutions like CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne run scheduled daily “threat intelligence sync” jobs. These agents proactively fetch the latest Mirai IOC lists from URLhaus to enrich their local detection engines, triggering network traffic that matches the rule’s logic.
  • Filter/Exclusion: Exclude traffic originating from EDR service processes (e.g., FalconSensor.exe, MsMpEng.exe) during defined maintenance windows (e.g., 02:00–04:00 UTC) or filter by specific User-Agent strings containing “CrowdStrike” or “Microsoft Defender”.

• Automated Vulnerability Scanning of External Assets

  • Scenario: Internal vulnerability management tools, such as Tenable Nessus or Qualys, perform external asset discovery scans. As