URLhaus: mirai Malicious URLs

Hunt Hypothesis

This detection identifies adversary activity involving traffic to seven specific malicious URLs associated with Mirai botnet campaigns, which are known to compromise IoT devices and initiate large-scale DDoS attacks. A SOC team should proactively hunt for these indicators in Azure Sentinel to rapidly isolate infected endpoints before they can be leveraged as part of a distributed attack infrastructure or used to exfiltrate sensitive data.

IOC Summary

Threat: mirai Total URLs: 7 Active URLs: 6

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: mirai
let malicious_domains = dynamic(["156.226.174.98", "129.121.110.105"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["156.226.174.98", "129.121.110.105"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

False Positive Scenarios for “URLhaus: mirai Malicious URLs” Rule

• IoT Device Firmware Updates

  • Scenario: Enterprise-managed IoT devices (e.g., Cisco Meraki cameras or Ubiquiti UniFi access points) automatically contacting their cloud management portals to download firmware patches. These updates often originate from CDN domains that share IP ranges with known Mirai botnet command-and-control servers, triggering the rule despite being legitimate maintenance traffic.
  • Filter/Exclusion: Create a whitelist exclusion for specific IoT device subnets (e.g., 10.50.20.0/24) or add the vendor’s update domain (e.g., firmware.cisco.com, update.ui.com) to the allow-list.

• Scheduled Cloud Backup Jobs

  • Scenario: Automated backup agents running on Windows Server workstations utilize third-party cloud storage providers (such as AWS S3 or Azure Blob Storage) that host Mirai-related security feeds. During scheduled nightly jobs, these agents query external URLs for status checks or manifest downloads, which may match the Mirai URL signature due to shared infrastructure.
  • Filter/Exclusion: Exclude traffic generated by specific service accounts (e.g., svc-backup-agent) and filter out URLs containing backup-specific path patterns like /api/v1/status or /manifest.xml during defined maintenance windows (e.g., 02:00–04:00 UTC).

• Endpoint Security Console Polling

  • Scenario: Enterprise Endpoint Detection and Response (EDR) tools, such as CrowdStrike Falcon or Microsoft Defender for Endpoint, periodically poll the vendor’s cloud console to retrieve threat intelligence updates. The polling mechanism often connects to Mirai-tagged URLs used by the security vendor for real-time signature synchronization.
  • Filter/Exclusion: Apply a