URLhaus: Mozi Malicious URLs

Hunt Hypothesis

This hunt detects adversaries leveraging the Mozi backdoor to establish persistent access through phishing-delivered malicious URLs, enabling them to execute remote commands and exfiltrate sensitive data. Proactive hunting for these indicators in Azure Sentinel is critical because Mozi’s stealthy nature allows attackers to maintain long-term footholds within the environment before traditional alerts trigger.

IOC Summary

Threat: Mozi Total URLs: 13 Active URLs: 12

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: Mozi
let malicious_domains = dynamic(["42.232.239.106", "110.36.77.162", "61.53.138.170", "115.53.247.204", "42.234.233.100", "112.248.163.115", "27.194.170.188"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["42.232.239.106", "110.36.77.162", "61.53.138.170", "115.53.247.204", "42.234.233.100", "112.248.163.115", "27.194.170.188"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 5 specific false positive scenarios for the URLhaus: Mozi Malicious URLs detection rule, including targeted filters and exclusions:

• Scenario: Automated Security Tool Updates via Cloud Repositories

  • Context: Enterprise Endpoint Detection and Response (EDR) agents (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint) or SIEM collectors frequently pull definition updates from cloud-hosted repositories that may host Mozi-related signatures or sample URLs. If the update server’s CDN domain is flagged by URLhaus as hosting a Mozi variant, legitimate update traffic triggers an alert.
  • Filter/Exclusion: Create a whitelist rule excluding traffic originating from specific EDR management servers (e.g., *.falcon.crowdstrike.com, *.microsoft.com) where the destination port is 443 and the user agent string contains “CrowdStrike” or “Defender”.

• Scenario: Scheduled Phishing Simulation Campaigns

  • Context: Security teams use platforms like Proofpoint, KnowBe4, or Mimecast to run internal phishing simulations. These tools often inject malicious-looking URLs into test emails that mimic real-world threats (including Mozi characteristics) to train users. When employees click these simulated links, the detection engine flags them as actual Mozi infections rather than training exercises.
  • Filter/Exclusion: Exclude traffic where the source IP belongs to the internal phishing simulation platform’s IP range and the URL path contains specific campaign identifiers (e.g., ?campaign=sim_2023_q4 or domain=training.internal.corp).

• Scenario: Admin-Driven Cloud Storage Sync Operations

  • Context: IT administrators frequently sync large datasets from cloud storage providers (e.g., OneDrive for Business, SharePoint Online) that utilize shared CDN nodes. If a specific CDN node is currently hosting a Mozi