URLhaus: Mozi Malicious URLs

Hunt Hypothesis

This detection identifies adversary activity involving the Mozi malware family by flagging network traffic to nine known malicious URLs that facilitate command and control or payload delivery. A SOC team should proactively hunt for these indicators in Azure Sentinel to rapidly isolate compromised endpoints before the malware establishes persistence or exfiltrates sensitive data.

IOC Summary

Threat: Mozi Total URLs: 9 Active URLs: 9

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: Mozi
let malicious_domains = dynamic(["182.126.120.131", "110.37.53.25", "110.37.14.156", "222.134.164.39", "115.56.149.89", "110.37.68.65", "42.230.44.235"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["182.126.120.131", "110.37.53.25", "110.37.14.156", "222.134.164.39", "115.56.149.89", "110.37.68.65", "42.230.44.235"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 5 specific false positive scenarios for the URLhaus: Mozi Malicious URLs detection rule, including suggested filters and exclusions tailored for an enterprise environment:

• Scenario: Automated Security Scanner Traffic

  • Context: Internal vulnerability scanners (e.g., Tenable Nessus, Qualys, or Rapid7 InsightVM) frequently probe external endpoints to validate certificate chains or test web application firewalls. These tools often generate high volumes of HTTP requests that may hit the specific Mozi-tagged URLs during their discovery phase, triggering alerts despite being benign traffic.
  • Filter/Exclusion: Create a rule exclusion based on the Source IP range of the security scanning servers or filter by User-Agent strings containing “Tenable,” “Qualys,” or “Rapid7.”

• Scenario: Scheduled Backup and Sync Operations

  • Context: Enterprise backup solutions (e.g., Veeam, Rubrik, or Microsoft Azure Arc) often include scheduled jobs that verify connectivity to external cloud storage endpoints or metadata services. If the Mozi detection logic flags a specific API endpoint used by these tools for health checks, it will generate recurring alerts during maintenance windows.
  • Filter/Exclusion: Implement an exclusion based on Process Name (e.g., Veeam.Backup.Service.exe, azcopy.exe) combined with a time-based filter to ignore alerts occurring outside of business hours if the job is known to run at night.

• Scenario: Endpoint Protection Quarantine and Analysis

  • Context: Next-Generation Antivirus (NGAV) platforms like CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint automatically send telemetry data, threat intelligence updates, or quarantine reports to external vendor URLs. The Mozi rule may misinterpret these routine telemetry uploads as malicious URL