URLhaus: mirai Malicious URLs

Hunt Hypothesis

This detection identifies Mirai malware activity that exploits IoT device vulnerabilities through malicious URL interactions to establish command-and-control channels or propagate botnet infections. A proactive hunt is essential in Azure Sentinel to rapidly isolate compromised IoT assets before they are leveraged for large-scale DDoS attacks or lateral movement within the network.

IOC Summary

Threat: mirai Total URLs: 6 Active URLs: 5

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: mirai
let malicious_domains = dynamic(["129.121.110.105", "105.184.156.91"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["129.121.110.105", "105.184.156.91"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 3-5 specific false positive scenarios for the URLhaus: mirai Malicious URLs detection rule, tailored for an enterprise environment:

• Scenario: Automated IoT Firmware Update Checks

  • Context: Enterprise-managed smart cameras (e.g., Axis Communications) or IP phones (e.g., Yealink) running scheduled background jobs to query vendor update servers. These devices often poll Mirai-associated domains to check for firmware patches, triggering the rule due to the nature of IoT traffic patterns resembling Mirai scanning behavior.
  • Filter/Exclusion: Create an exclusion based on the source IP range of the corporate IoT VLAN (e.g., 10.50.20.0/24) and whitelist specific vendor update domains such as update.axis.com or firmware.yealink.com.

• Scenario: Network Security Scanning by Internal Tools

  • Context: Internal vulnerability management tools like Tenable Nessus or Qualys perform periodic external asset discovery. When these scanners probe the public-facing IP addresses of IoT gateways, they generate HTTP GET requests to known Mirai command-and-control (C2) URLs as part of their baseline fingerprinting process.
  • Filter/Exclusion: Exclude traffic originating from the dedicated scanner management IPs (e.g., 192.168.10.5 for Nessus Manager) when the destination URL matches known Mirai C2 patterns, provided the HTTP status code is 200 OK.

• Scenario: Cloud-Based IoT Management Platform Synchronization

  • Context: The enterprise utilizes a cloud IoT platform like Microsoft Azure IoT Hub or AWS IoT Core. These platforms periodically synchronize device telemetry and configuration states by establishing outbound connections to Mirai-related registry URLs, which the detection logic interprets as potential malware communication.