URLhaus: mirai Malicious URLs

Hunt Hypothesis

This hunt detects adversary activity where internal assets communicate with known Mirai botnet command-and-control infrastructure via specific malicious URLs identified by URLhaus. Proactively hunting for these connections in Azure Sentinel is critical to identify early-stage IoT device compromises before they escalate into large-scale network scanning or DDoS attacks.

IOC Summary

Threat: mirai Total URLs: 2 Active URLs: 2

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: mirai
let malicious_domains = dynamic(["120.28.200.193", "105.184.236.22"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["120.28.200.193", "105.184.236.22"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios for the URLhaus: mirai Malicious URLs detection rule in an enterprise environment, along with suggested filters and exclusions:

• IoT Device Firmware Updates via Vendor Portals

  • Scenario: Enterprise-managed IoT devices (e.g., Cisco Meraki cameras, Ubiquiti UniFi access points) automatically connect to vendor update servers or cloud management dashboards. These legitimate endpoints often query URLs that host firmware binaries and configuration scripts which share IP ranges or domain structures with known Mirai-infected infrastructure, triggering the URLhaus match despite being benign traffic.
  • Filter/Exclusion: Create an exclusion rule for specific IoT device asset groups (e.g., Asset_Group = "IoT_Cameras") connecting to whitelisted vendor domains (e.g., *.meraki.com, *.ui.com). Additionally, filter out traffic originating from the internal VLAN dedicated to IoT devices (Source_Net = 10.50.x.x/24) when the destination URL contains known vendor signatures.

• Scheduled Vulnerability Scanning and Asset Discovery

  • Scenario: Enterprise vulnerability management tools (such as Tenable Nessus, Qualys, or Rapid7 InsightVM) perform scheduled scans that probe external URLs to validate certificate chains, check for open ports, and verify service availability. These scanners often generate HTTP/HTTPS requests to a wide array of public IPs, including those flagged by URLhaus as Mirai-related, resulting in high-volume false positives during nightly scan windows (e.g., 02:00 – 04:00 UTC).
  • Filter/Exclusion: Exclude traffic generated by known scanner service accounts or IP ranges (e.g., Source_IP = "192.168.10.5-10" for Tenable agents) during scheduled maintenance windows