URLhaus: Mozi Malicious URLs

Hunt Hypothesis

This detection identifies adversary activity where users or systems interact with malicious URLs associated with the Mozi malware campaign, which is known to deliver payloads that compromise endpoint integrity and exfiltrate sensitive data. A SOC team should proactively hunt for these indicators in Azure Sentinel to rapidly isolate affected assets and prevent lateral movement before the malware establishes persistence within the network environment.

IOC Summary

Threat: Mozi Total URLs: 3 Active URLs: 3

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: Mozi
let malicious_domains = dynamic(["115.63.189.195", "27.215.121.130", "115.57.15.114"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["115.63.189.195", "27.215.121.130", "115.57.15.114"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 4 specific false positive scenarios for the URLhaus: Mozi Malicious URLs detection rule, along with targeted filtering strategies:

• Scenario: Automated Security Tool Updates via Cloud Repositories

  • Context: Enterprise security suites like CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint frequently pull configuration updates and threat intelligence feeds from cloud endpoints that host Mozi-related signatures. These automated background processes often generate HTTP/HTTPS requests to URLs flagged by URLhaus as “Mozi” but are actually benign update sources used by the security vendor itself.
  • Filter/Exclusion: Create a whitelist exclusion for specific hostnames or IP ranges associated with your primary endpoint protection vendor (e.g., *.falcon.crowdstrike.com, *.sentinelone.net). Additionally, exclude traffic originating from the “System” account on servers running these agents during scheduled maintenance windows.

• Scenario: Scheduled Backup and Archiving Jobs

  • Context: Enterprise backup solutions such as Veeam Backup & Replication, Rubrik, or Acronis Cyber Protect often utilize external storage gateways or cloud connectors that may share infrastructure with Mozi-tagged domains. During nightly scheduled jobs (e.g., running at 02:00 AM via Task Scheduler), these agents initiate connections to backup repositories that trigger the URLhaus rule due to shared SSL certificates or CDN nodes.
  • Filter/Exclusion: Exclude traffic generated by specific service accounts used for backups (e.g., svc-veeam-backup, AcronisService) and filter out URLs containing known backup vendor subdomains (e.g., *.rubrik.com, *.acronis.cloud). Implement a time-based exclusion to ignore alerts from these sources outside of business hours if the jobs are strictly scheduled.

• **Scenario: Legitimate Third