URLhaus: Mozi Malicious URLs

Hunt Hypothesis

The hunt hypothesis detects adversaries using Mozi malware by accessing malicious URLs listed in URLhaus, which are known to be used for command and control or data exfiltration. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify and mitigate potential compromises early in the attack lifecycle.

IOC Summary

Threat: Mozi Total URLs: 14 Active URLs: 14

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: Mozi
let malicious_domains = dynamic(["222.141.82.197", "112.239.103.39", "210.10.133.136", "112.240.175.223", "219.154.28.83", "61.53.95.140", "182.112.0.25", "220.202.66.241", "151.41.153.146", "182.112.224.78"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["222.141.82.197", "112.239.103.39", "210.10.133.136", "112.240.175.223", "219.154.28.83", "61.53.95.140", "182.112.0.25", "220.202.66.241", "151.41.153.146", "182.112.224.78"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

• Scenario: A system administrator is manually testing a new URL shortener tool by accessing a known safe URL from URLhaus for validation purposes.
  Filter/Exclusion: Exclude URLs that match the urlhaus domain or any URLs associated with known security testing tools (e.g., urlhaus.org, test-url-shortener.com).

• Scenario: A scheduled job runs to fetch and process updates from URLhaus as part of an automated threat intelligence integration.
  Filter/Exclusion: Exclude URLs that originate from the urlhaus API endpoint or any known threat intel integration tools (e.g., urlhaus-api.com, threatintel-updater.sh).

• Scenario: A user is accessing a legitimate internal documentation portal that includes a link to a URLhaus page for reference.
  Filter/Exclusion: Exclude URLs containing the exact string urlhaus or any URLs that match internal documentation domains (e.g., internal-docs.example.com, knowledge-base.example.com).

• Scenario: A security analyst is performing a red team exercise and uses a Mozi-related URL as part of a controlled simulation.
  Filter/Exclusion: Exclude URLs that match red team tooling identifiers (e.g., redteam-simulator.example.com, mozi-sim-01.example.com) or any URLs with the redteam keyword in the path.

• Scenario: A backup or synchronization job is transferring files from a system that previously had a Mozi-related URL in its configuration, now removed.
  Filter/Exclusion: Exclude URLs that are part of backup processes or system configuration archives (e.g., backup-logs.tar.gz, config-backup-2024-04-01.xml).