URLhaus: mirai Malicious URLs

Hunt Hypothesis

This detection identifies adversary behavior where IoT devices or network endpoints access known Mirai botnet command-and-control URLs to facilitate initial infection and lateral movement. A SOC team should proactively hunt for these indicators in Azure Sentinel to rapidly isolate compromised assets before they are recruited into a large-scale botnet capable of launching distributed denial-of-service attacks.

IOC Summary

Threat: mirai Total URLs: 3 Active URLs: 3

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: mirai
let malicious_domains = dynamic(["117.131.92.150", "38.21.70.189"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["117.131.92.150", "38.21.70.189"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the URLhaus: mirai Malicious URLs detection rule:

• Scenario: IoT Device Firmware Update Scans

  • Context: Enterprise networked devices (e.g., Cisco IP Cameras, Ubiquiti Access Points) frequently initiate outbound connections to vendor update servers. These devices often scan or download firmware from domains that share IP ranges or URL structures with known Mirai botnet command-and-control (C2) infrastructure.
  • Filter/Exclusion: Create a whitelist for specific IoT device subnets (e.g., 10.50.10.0/24) and exclude URLs containing vendor-specific update paths, such as *.cisco.com/firmware or *.ubnt.com/update.

• Scenario: Scheduled Vulnerability Scanner Probes

  • Context: Automated security tools like Tenable Nessus, Qualys, or Rapid7 InsightVM run scheduled jobs to probe external endpoints. These scanners often query known malicious URL lists (including Mirai signatures) as part of their baseline health checks, triggering the rule when they access a “malicious” test endpoint that is actually benign in this context.
  • Filter/Exclusion: Exclude traffic originating from specific scanner service accounts or IP ranges (e.g., 192.168.5.10-15) and filter out requests where the User-Agent string contains keywords like Tenable, Qualys, or Rapid7.

• Scenario: Admin Cloud Backup and Sync Operations

  • Context: Administrators using cloud management platforms (e.g., Microsoft Azure Arc, AWS Systems Manager) may trigger backup jobs that connect to external storage buckets. If these storage endpoints utilize shared CDN services or IP blocks commonly associated with Mirai IoT traffic, the URL