URLhaus: Mozi Malicious URLs

Hunt Hypothesis

The hypothesis is that the detected URLs are associated with the Mozi malware, which is used to deliver payloads and establish command and control channels. SOC teams should proactively hunt for these URLs in Azure Sentinel to identify and mitigate potential compromise of endpoints and networks.

IOC Summary

Threat: Mozi Total URLs: 9 Active URLs: 9

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: Mozi
let malicious_domains = dynamic(["27.207.36.59", "123.5.124.22", "222.142.244.164", "116.72.98.65", "119.183.26.44", "182.127.81.12", "182.114.194.60"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["27.207.36.59", "123.5.124.22", "222.142.244.164", "116.72.98.65", "119.183.26.44", "182.127.81.12", "182.114.194.60"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Scenario: Legitimate system update or patching process using a URLhaus-listed URL
  Filter/Exclusion: Exclude URLs matching known patching or update servers (e.g., *.patch.microsoft.com, *.updates.redhat.com) or use a custom list of approved update URLs.

• Scenario: Scheduled backup job downloading a Mozi-related tool from a trusted internal repository
  Filter/Exclusion: Exclude URLs containing backup or snapshot in the path, or filter by source IP from internal backup servers (e.g., 10.0.0.0/8).

• Scenario: Admin performing a security scan using a Mozi-related tool for compliance testing
  Filter/Exclusion: Exclude URLs containing scan, test, or compliance in the request path, or filter by user agent matching known security tools (e.g., Mozilla/5.0 (compatible; QualysGuard)).

• Scenario: Internal development team using a Mozi-based tool for internal testing
  Filter/Exclusion: Exclude URLs from internal development domains (e.g., dev.example.com) or filter by user group (e.g., dev-team).

• Scenario: Automated log collection tool pulling logs from a Mozi-tagged endpoint for analysis
  Filter/Exclusion: Exclude URLs containing logs, logstash, or syslog in the path, or filter by source IP from internal log aggregation systems (e.g., 192.168.1.0/24).