URLhaus: Mozi Malicious URLs

Hunt Hypothesis

This hunt targets adversaries leveraging Mozi malware to establish command and control channels via known malicious URLs, which often serve as initial infection vectors or persistence mechanisms within cloud workloads. Proactively hunting for these specific indicators in Azure Sentinel is critical because early detection of Mozi-tagged traffic allows the SOC team to isolate compromised assets before lateral movement occurs across the tenant environment.

IOC Summary

Threat: Mozi Total URLs: 2 Active URLs: 2

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: Mozi
let malicious_domains = dynamic(["115.48.133.253", "182.121.108.126"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["115.48.133.253", "182.121.108.126"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 5 specific false positive scenarios for the URLhaus: Mozi Malicious URLs detection rule in an enterprise environment, along with suggested filters or exclusions:

• Legacy Software License Verification

  • Scenario: Older versions of internal legacy applications (e.g., SAP NetWeaver or custom Java-based ERP modules) perform automated license validation checks against vendor endpoints. These vendors often host their verification scripts on shared subdomains that may have recently been flagged by URLhaus as “Mozi” due to a transient campaign, even though the traffic is strictly outbound and read-only.
  • Filter/Exclusion: Create an exclusion for specific destination IP ranges or fully qualified domain names (FQDNs) associated with known vendor license servers (e.g., *.license.sap.com), provided the user agent string matches the legacy application version and no file downloads occur during the session.

• Automated Patch Management Scans

  • Scenario: The enterprise patch management system, such as Microsoft Endpoint Configuration Manager (MECM/SCCM) or Ivanti, initiates scheduled background jobs to scan for available updates. These agents frequently query third-party repository mirrors or software distribution points that URLhaus has tagged with the “Mozi” signature due to high-volume traffic patterns resembling bot behavior, despite being legitimate administrative tasks.
  • Filter/Exclusion: Exclude traffic originating from specific service accounts (e.g., svc-patch-agent) and destination ports commonly used for patching (80/443) during defined maintenance windows (e.g., 2:00 AM – 5:00 AM local time), ensuring the HTTP method is limited to GET or HEAD.

• Cloud Backup Agent Connectivity Checks

  • Scenario: Cloud backup agents like Veeam Backup & Replication or