URLhaus: mirai Malicious URLs

Hunt Hypothesis

This hunt targets the presence of known Mirai botnet command-and-control or download URLs to identify hosts that may be compromised or actively staging malware payloads. Proactively hunting for these specific indicators in Azure Sentinel allows the SOC to detect early-stage infections and lateral movement attempts before the botnet can fully establish its foothold and propagate across the network.

IOC Summary

Threat: mirai Total URLs: 5 Active URLs: 3

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: mirai
let malicious_domains = dynamic(["222.127.77.227", "122.241.130.94"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["222.127.77.227", "122.241.130.94"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Legacy IoT Device Firmware Updates: Embedded devices (e.g., IP cameras, smart thermostats, or industrial PLCs) running outdated firmware may still reference hardcoded URLs from the Mirai botnet’s original distribution or update servers for legacy compatibility checks.

  • Filter/Exclusion: Exclude source IPs belonging to the IoT/OT network segment (e.g., 192.168.10.0/24) or specific device asset tags (e.g., asset_tag: "iot-camera") from the URL match criteria.

• Security Testing and Penetration Exercises: During authorized red team engagements or vulnerability assessments, testers intentionally access known malicious URLs to verify network egress controls, proxy logging, or endpoint detection capabilities.

  • Filter/Exclusion: Correlate with the ticketing system (e.g., Jira/ServiceNow) to exclude events occurring within the timestamp window of an active “Pen Test” or “Red Team” ticket, or exclude users with the security_tester AD group membership.

• Web Proxy or WAF Rule Testing: Network engineers or security administrators may use tools like curl, wget, or browser dev tools to validate that the web proxy or Web Application Firewall (WAF) is correctly blocking or logging specific known-bad URLs as part of routine configuration audits.

  • Filter/Exclusion: Exclude events where the source user is a member of the network-admins or security-ops AD group, or where the user agent string contains curl/ or Wget/ and the destination port is 80/443 from a management subnet.

• Threat Intelligence Feed Synchronization: SIEM or EDR platforms may periodically fetch threat intelligence feeds (including URLhaus data) from a central repository or API endpoint that hosts these specific URLs as part of a