URLhaus: mirai Malicious URLs

Hunt Hypothesis

This detection identifies network traffic connecting to known Mirai botnet command-and-control URLs, signaling potential IoT device compromise or lateral movement by threat actors leveraging Mirai variants. Proactively hunting for these indicators in Azure Sentinel is critical to rapidly isolate infected endpoints and prevent the propagation of large-scale DDoS attacks before they disrupt core infrastructure.

IOC Summary

Threat: mirai Total URLs: 3 Active URLs: 3

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: mirai
let malicious_domains = dynamic(["91.92.42.213"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["91.92.42.213"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: Mirai Malicious URLs detection rule, along with targeted exclusion strategies suitable for an enterprise environment:

• IoT Device Firmware Update Scans

  • Scenario: Enterprise IoT devices (e.g., Cisco Meraki APs, Aruba switches) or smart office peripherals periodically contact vendor update servers to check for firmware patches. These endpoints often scan URLs that share hash signatures with known Mirai botnet command-and-control (C2) infrastructure due to overlapping IP ranges in public CDN networks.
  • Filter/Exclusion: Create a whitelist exclusion based on the specific Source Hostname or Destination FQDN. For example, exclude traffic from meraki.cisco.com, arubanetworks.com, and known IoT management subnets (e.g., 10.50.20.0/24) where these devices reside.

• Scheduled Antivirus Definition Cloud Queries

  • Scenario: Endpoint Protection platforms like CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint run scheduled jobs (typically every 6 hours) to query the cloud for the latest threat intelligence feeds. These queries often hit URLhaus endpoints that host Mirai signatures, triggering the rule even though the traffic is a legitimate health check rather than an infection.
  • Filter/Exclusion: Implement a process-based exclusion targeting the specific EDR agent service names (e.g., C-Service.exe, SentinelOne.exe, MsMpEng.exe). Additionally, exclude traffic occurring during known maintenance windows (e.g., 02:00–04:00 UTC) if the rule fires exclusively during these times.

• Third-Party Supply Chain Vulnerability Scanners

  • Scenario: Automated security tools such as **Tenable Nessus