URLhaus: mirai Malicious URLs

Hunt Hypothesis

This hunt targets adversary behavior where IoT devices or network assets communicate with known Mirai botnet command-and-control servers via specific malicious URLs identified by URLhaus. Proactively hunting for these connections in Azure Sentinel is critical to detect early-stage botnet infections and prevent potential large-scale distributed denial-of-service (DDoS) attacks before they propagate across the environment.

IOC Summary

Threat: mirai Total URLs: 2 Active URLs: 2

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: mirai
let malicious_domains = dynamic(["125.44.155.10"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["125.44.155.10"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios for the URLhaus: mirai Malicious URLs detection rule in an enterprise environment, along with suggested filters and exclusions:

• IoT Device Firmware Updates via Cloud Repositories

  • Scenario: Enterprise-managed IoT devices (e.g., Cisco Meraki cameras or Ubiquiti UniFi access points) automatically query public firmware update servers. These servers often host binaries that share hash signatures or URL structures with known Mirai variants, particularly when the repository hosts a large volume of embedded Linux images. The detection logic may flag these legitimate download requests as malicious traffic.
  • Filter/Exclusion: Create an exclusion rule for source IP ranges belonging to the internal IoT VLAN (e.g., 10.x.x.0/24) or specific device FQDNs (e.g., *.ubnt.com, cisco.com). Additionally, whitelist destination URLs containing keywords like /firmware/ or /update/ if they originate from trusted CDNs.

• Scheduled Vulnerability Scans by Security Tools

  • Scenario: Automated vulnerability scanners such as Tenable Nessus, Qualys, or Rapid7 InsightVM periodically probe external endpoints to check for Mirai-specific vulnerabilities (e.g., SSH brute force configurations). During these scans, the tools actively resolve and connect to known malicious URL databases (like URLhaus itself) to cross-reference signatures. The scanner’s outbound traffic to these intelligence feeds may trigger the rule if the feed contains the specific “mirai” tagged URLs being hunted.
  • Filter/Exclusion: Exclude traffic originating from the dedicated security management subnet or specific service accounts used by scanning tools (e.g., svc-nessus-scan). Filter for HTTP methods limited to GET and HEAD requests targeting known threat intelligence domains (e.g., urlhaus.abuse.ch) during