URLhaus: Mozi Malicious URLs

Hunt Hypothesis

This hypothesis detects adversary activity involving the Mozi malware family by identifying user or system interactions with known malicious URLs that facilitate initial infection and command-and-control communication. Proactively hunting for these indicators in Azure Sentinel is critical to rapidly isolate compromised endpoints before the malware establishes persistence and exfiltrates sensitive data from the environment.

IOC Summary

Threat: Mozi Total URLs: 7 Active URLs: 7

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: Mozi
let malicious_domains = dynamic(["42.232.57.246", "27.204.197.113", "115.49.200.94", "27.194.244.206", "110.36.27.209", "182.114.199.247"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["42.232.57.246", "27.204.197.113", "115.49.200.94", "27.194.244.206", "110.36.27.209", "182.114.199.247"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 5 specific false positive scenarios and their corresponding filters/exclusions for the URLhaus: Mozi Malicious URLs detection rule in an enterprise environment:

• Scenario: Automated Security Scanner Traffic

  • Context: Internal vulnerability scanners (e.g., Tenable Nessus, Qualys, or Rapid7 InsightVM) frequently probe external endpoints to validate certificate chains and reachability. These tools often generate high-volume HTTP/HTTPS requests that mimic the traffic patterns of Mozi malware, triggering alerts on URLs containing specific query parameters or path structures associated with the Mozi signature.
  • Filter/Exclusion: Create a rule exclusion based on the Source IP Address range assigned to the scanner appliances and the User Agent string (e.g., Tenable-Nessus or Qualys-Cloud-Agent).

• Scenario: Scheduled Cloud Backup & Synchronization Jobs

  • Context: Enterprise backup solutions like Veeam, Rubrik, or Microsoft Azure Backup perform scheduled synchronization tasks that connect to cloud storage endpoints. These jobs often utilize URLs with complex token structures and specific subdomains (e.g., *.storage.azure.com or *.s3.amazonaws.com) which may overlap with the Mozi URL taxonomy, particularly when accessing API gateways for metadata retrieval.
  • Filter/Exclusion: Exclude traffic originating from the Service Account identities used by these backup tools (e.g., svc-backup-azure, svc-rubrik-agent) and filter out specific destination domains known to be part of the approved cloud infrastructure whitelist.

• Scenario: Third-Party SaaS Integration Webhooks

  • Context: Business applications such as Salesforce, ServiceNow, or Workday utilize webhooks to push real-time data updates to internal ERP systems or external partners. These integrations