URLhaus: mirai Malicious URLs

Hunt Hypothesis

This hunt targets adversary behavior where IoT devices or internal hosts communicate with known Mirai botnet command-and-control servers via specific malicious URLs identified by URLhaus. Proactively hunting for these connections in Azure Sentinel is critical to detect early-stage Mirai infections before they escalate into large-scale network scanning and DDoS attacks that could compromise infrastructure availability.

IOC Summary

Threat: mirai Total URLs: 2 Active URLs: 2

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: mirai
let malicious_domains = dynamic(["182.126.194.87"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["182.126.194.87"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios for the URLhaus: mirai Malicious URLs detection rule in an enterprise environment, along with suggested filters and exclusions:

• IoT Device Firmware Update Cycles

  • Scenario: Managed IoT devices (e.g., Cisco Meraki cameras or Ubiquiti UniFi Access Points) automatically query the manufacturer’s update servers to check for firmware patches. These legitimate update endpoints often share IP ranges or URL patterns with known Mirai botnet command-and-control (C2) infrastructure, triggering the rule during nightly maintenance windows.
  • Suggested Filter: Exclude traffic originating from specific IoT VLANs or device MAC address prefixes where the destination domain matches the vendor’s official update repository (e.g., *.cisco.com, *.ubnt.com) and the HTTP User-Agent contains the device model name rather than a generic browser string.

• Automated Vulnerability Scanning by Security Tools

  • Scenario: Enterprise vulnerability scanners like Tenable Nessus, Qualys, or Rapid7 InsightVM perform scheduled external scans of public-facing assets. During these scans, the scanner probes known malicious URL patterns to verify web server configurations and SSL certificates, generating traffic that mimics Mirai infection behavior (high volume of GET requests to specific ports).
  • Suggested Filter: Create an exclusion for source IPs belonging to the security scanning team’s jump hosts or cloud-based scanner instances. Additionally, filter out events where the HTTP User-Agent header explicitly identifies the scanning tool (e.g., Nessus/10.x, QualysAgent) and the request frequency aligns with the scheduled scan window (e.g., 02:00–04:00 UTC).

• Network Administration and Patch Management Jobs

  • Scenario: System administrators utilize tools like Ansible, **SCCM (