URLhaus: Mozi Malicious URLs

Hunt Hypothesis

This hunt targets adversary behavior where attackers leverage compromised or newly registered domains associated with the Mozi malware family to deliver malicious payloads via web traffic. Proactively hunting these specific URL patterns in Azure Sentinel is critical because early detection of Mozi-related web interactions can prevent lateral movement and data exfiltration before the malware fully establishes persistence on endpoints.

IOC Summary

Threat: Mozi Total URLs: 14 Active URLs: 14

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: Mozi
let malicious_domains = dynamic(["42.227.204.153", "42.228.91.45", "115.49.2.134", "115.50.248.116", "222.139.114.66", "125.45.8.67", "112.249.186.196", "61.52.39.66", "42.226.90.121", "59.180.171.2"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["42.227.204.153", "42.228.91.45", "115.49.2.134", "115.50.248.116", "222.139.114.66", "125.45.8.67", "112.249.186.196", "61.52.39.66", "42.226.90.121", "59.180.171.2"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 5 specific false positive scenarios for the URLhaus: Mozi Malicious URLs detection rule in an enterprise environment, along with suggested filters or exclusions:

• Endpoint Security Agent Health Checks

  • Scenario: The organization’s endpoint protection suite (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) performs periodic background health checks and definition updates. These agents often query known threat intelligence feeds directly from the host, including URLhaus endpoints, to validate their own signature databases against current Mozi campaign indicators.
  • Filter/Exclusion: Exclude network traffic originating from the specific service accounts or process names of the EDR agent (e.g., CrowdStrikeService, MsMpEng.exe) connecting to the urlhaus.abuse.ch domain or its associated IP ranges, specifically on ports 443 and 80.

• Automated Vulnerability Scanning Jobs

  • Scenario: Scheduled vulnerability scanners (such as Tenable Nessus or Qualys) run daily discovery jobs that probe internal web servers and public-facing applications. As part of their baseline configuration, these scanners actively fetch and parse external threat feeds to cross-reference known malicious URLs against the organization’s asset inventory before generating reports.
  • Filter/Exclusion: Create a rule exclusion for traffic generated by the scanner’s service account (e.g., svc-nessus-scan) during the defined maintenance window (e.g., 02:00–04:00 UTC), filtering out connections to URLhaus API endpoints that result in HTTP 200 responses.

• IT Admin Manual Threat Intelligence Review

  • Scenario: Security Operations Center (SOC) analysts or IT administrators manually access the URLhaus web portal via their corporate browsers to review the latest Mozi campaign details, download CSV reports of malicious URLs, and verify specific indicators for ongoing investigations