URLhaus: mirai Malicious URLs

Hunt Hypothesis

This detection identifies network traffic connecting to known Mirai botnet command-and-control URLs, signaling potential IoT device compromise and active participation in large-scale DDoS campaigns. Proactive hunting for these indicators within Azure Sentinel is critical to rapidly isolate infected endpoints before they can propagate lateral threats or exhaust bandwidth resources across the enterprise infrastructure.

IOC Summary

Threat: mirai Total URLs: 8 Active URLs: 8

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: mirai
let malicious_domains = dynamic(["105.184.108.47", "103.172.186.156", "116.68.162.210", "196.189.35.172", "105.224.82.249"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["105.184.108.47", "103.172.186.156", "116.68.162.210", "196.189.35.172", "105.224.82.249"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 5 specific false positive scenarios for the URLhaus: mirai Malicious URLs detection rule, along with targeted filters and exclusions suitable for an enterprise environment:

• IoT Device Firmware Updates via Cloud Repositories

  • Scenario: Enterprise-managed IoT devices (e.g., Cisco Meraki APs, Aruba switches, or Ubiquiti UniFi controllers) automatically query cloud repositories to check for firmware updates. These repositories often host files on domains that share IP ranges with known Mirai botnet command-and-control (C2) infrastructure, triggering the rule when a device initiates an update download.
  • Filter/Exclusion: Create a whitelist exclusion based on specific IoT management subnets (e.g., 10.50.40.0/24) or exclude known vendor domains such as *.cisco.com, *.ubnt.com, and *.aruba-networks.com from the rule logic if their update traffic matches the Mirai URL signature.

• Automated Security Scanner Probing

  • Scenario: Internal vulnerability management tools like Tenable Nessus, Qualys, or Rapid7 InsightVM perform scheduled external asset discovery scans. These scanners often probe public-facing IPs and may request specific URLs that are flagged by URLhaus as Mirai-related, mistaking the scanner’s active probing traffic for a potential botnet infection on an endpoint.
  • Filter/Exclusion: Exclude traffic originating from the IP addresses of internal security appliances (e.g., 192.168.50.10 for Tenable) or filter out events where the source user agent contains keywords like “Nessus”, “Qualys”, or “Rapid7”.

• Scheduled Backup and Replication Jobs

  • Scenario: Enterprise backup solutions such as **Veeam