URLhaus: Mozi Malicious URLs

Hunt Hypothesis

This detection identifies adversary activity involving the Mozi malware family by monitoring network traffic against a curated set of four known malicious URLs from URLhaus. Proactively hunting for these indicators in Azure Sentinel is critical to rapidly detect early-stage infections and prevent potential data exfiltration or lateral movement before the threat spreads across the enterprise environment.

IOC Summary

Threat: Mozi Total URLs: 4 Active URLs: 4

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: Mozi
let malicious_domains = dynamic(["115.63.54.54", "27.202.25.231", "182.113.35.171", "112.242.20.4"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["115.63.54.54", "27.202.25.231", "182.113.35.171", "112.242.20.4"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 5 specific false positive scenarios for the URLhaus: Mozi Malicious URLs detection rule, along with targeted filters and exclusions tailored for an enterprise environment:

• Scenario: Scheduled Security Scanner Probing

  • Context: Internal vulnerability management tools (e.g., Tenable Nessus, Qualys, or Rapid7 InsightVM) perform daily scans that include external URL validation. These scanners often probe known malicious feed URLs to verify their own detection capabilities, triggering alerts when the scanner’s service account accesses a Mozi-tagged URL for testing purposes.
  • Filter/Exclusion: Exclude traffic originating from specific scanner IP ranges or hostnames (e.g., *.tenable.com, qualysguard.com) where the user agent contains keywords like “Nessus,” “Qualys,” or “Rapid7.” Additionally, filter out alerts where the source process is identified as a known security service executable (e.g., nessuscli.exe, qgagent.exe).

• Scenario: Admin Manual Threat Intelligence Research

  • Context: Security analysts and SOC engineers frequently access threat intelligence platforms to investigate specific campaigns. When an analyst manually visits the URLhaus dashboard or a Mozi-specific report page (e.g., via Microsoft Defender for Office 365, CrowdStrike Falcon Insight, or direct browser navigation) to review a specific hash, their legitimate browsing activity triggers the rule.
  • Filter/Exclusion: Create an exclusion group based on user accounts belonging to the “SOC-Team” or “Security-Admins” Active Directory groups. Alternatively, filter alerts where the destination URL contains specific threat intelligence domain patterns (e.g., urlhaus.abusix.com, mozi-security.com) and the source process is a standard browser (chrome.exe, msedge.exe).

• **Scenario: Automated Software