URLhaus: mirai Malicious URLs

Hunt Hypothesis

This detection rule identifies network traffic connecting to known Mirai botnet command-and-control URLs, signaling potential IoT device compromise or lateral movement by adversaries leveraging this malware family. Proactively hunting for these indicators in Azure Sentinel is critical to rapidly isolate infected endpoints before they are recruited into a large-scale botnet capable of launching distributed denial-of-service (DDoS) attacks against internal infrastructure.

IOC Summary

Threat: mirai Total URLs: 10 Active URLs: 9

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: mirai
let malicious_domains = dynamic(["171.38.221.210", "210.208.110.147", "105.186.85.41", "222.219.74.184", "110.37.56.122", "106.40.240.38"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["171.38.221.210", "210.208.110.147", "105.186.85.41", "222.219.74.184", "110.37.56.122", "106.40.240.38"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

False Positive Scenarios for “URLhaus: mirai Malicious URLs” Rule

• IoT Firmware Update via Scheduled Task

  • Scenario: Enterprise network appliances (e.g., Cisco Meraki, Ubiquiti UniFi) or smart office devices run nightly scheduled jobs to check vendor repositories for firmware updates. These jobs often query URL endpoints hosted on the same infrastructure that hosts Mirai IoT botnet command-and-control servers, triggering a match due to shared IP ranges or similar domain structures.
  • Filter/Exclusion: Create an exclusion rule based on the specific Source Host (e.g., IoT-Update-Scheduler) and the Destination URL containing known vendor domains (e.g., *.meraki.com, *.ubnt.com). Alternatively, add these specific URLs to a “Known Good” allowlist within the detection logic.

• Security Information Management (SIM) Dashboard Refresh

  • Scenario: The centralized security dashboard (e.g., Splunk Enterprise Security or Microsoft Sentinel) executes a recurring background process to fetch threat intelligence feeds from URLhaus directly. If the ingestion pipeline queries the specific Mirai-tagged URLs for metadata enrichment, the rule may flag these internal API calls as external malicious traffic.
  • Filter/Exclusion: Exclude traffic originating from the security management server’s IP address (e.g., 10.20.30.5) where the User Agent string contains “Splunk-Collector” or “Sentinel-Agent”.

• DevOps CI/CD Pipeline Artifact Retrieval

  • Scenario: During a Jenkins or GitLab CI pipeline execution, build agents pull dependencies from public repositories that mirror content from URLhaus. If the build process downloads a specific library or artifact hosted on a domain flagged by URLhaus as Mirai-related (due to shared hosting), the download traffic triggers the alert during routine