URLhaus: mirai Malicious URLs

Hunt Hypothesis

This hunt targets adversary behavior where IoT devices communicate with known Mirai-associated malicious URLs to establish botnet membership and prepare for coordinated DDoS attacks. Proactively hunting for these connections in Azure Sentinel is critical to identify compromised endpoints before they are leveraged as part of a larger, resource-draining attack infrastructure.

IOC Summary

Threat: mirai Total URLs: 3 Active URLs: 3

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: mirai
let malicious_domains = dynamic(["119.178.242.230", "105.224.109.82"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["119.178.242.230", "105.224.109.82"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: mirai Malicious URLs detection rule in an enterprise environment, along with recommended filters or exclusions:

• IoT Firmware Update Scans by Management Platforms

  • Scenario: Enterprise IoT management tools (such as Cisco Meraki, Ubiquiti UniFi, or SolarWinds NPM) routinely scan connected devices to check for firmware vulnerabilities. These scanners often query known Mirai-infected IP ranges or specific update servers that host the malware’s signature files to validate device health, triggering the rule despite being a legitimate administrative task.
  • Filter/Exclusion: Create an exclusion based on the Source IP of the IoT management platform’s internal scanner service and restrict the detection to non-internal subnets (e.g., exclude traffic from 10.x.x.x or specific VLANs dedicated to Device Management).

• Scheduled Vulnerability Assessment Jobs

  • Scenario: Automated vulnerability scanners like Tenable Nessus, Qualys, or Rapid7 InsightVM run scheduled jobs that probe external URLs and IoT endpoints. During these scans, the tools may retrieve content from repositories known to host Mirai samples (or mirrors of them) to test network segmentation and firewall rules, generating alerts for “Malicious URL” hits on trusted scanner traffic.
  • Filter/Exclusion: Implement a time-based filter or an exclusion rule targeting the specific Service Account or Hostnames used by the vulnerability scanners (e.g., scanner-01.corp.local) during their defined maintenance windows (e.g., 02:00–04:00 UTC).

• Security Information and Event Management (SIEM) Threat Intelligence Feeds

  • Scenario: The organization’s SIEM or EDR solution (such as Splunk, **