URLhaus: Mozi Malicious URLs

Hunt Hypothesis

This detection rule identifies adversary behavior where threat actors leverage newly identified Mozi malware distribution campaigns to deliver malicious payloads via specific URL patterns. A SOC team should proactively hunt for these indicators in Azure Sentinel to rapidly isolate compromised endpoints and prevent lateral movement before the broader Mozi infection wave impacts critical infrastructure.

IOC Summary

Threat: Mozi Total URLs: 16 Active URLs: 14

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: Mozi
let malicious_domains = dynamic(["115.57.60.150", "119.183.25.240", "115.63.241.84", "42.225.60.179", "221.15.11.99", "125.47.239.251", "125.43.107.168", "125.47.34.218", "182.124.41.191", "123.8.82.72"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["115.57.60.150", "119.183.25.240", "115.63.241.84", "42.225.60.179", "221.15.11.99", "125.47.239.251", "125.43.107.168", "125.47.34.218", "182.124.41.191", "123.8.82.72"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios and corresponding filters for the URLhaus: Mozi Malicious URLs detection rule in an enterprise environment:

• Scenario: Automated Threat Intelligence Feeds Ingestion

  • Context: The Security Information and Event Management (SIEM) or EDR platform (e.g., Splunk, Microsoft Sentinel, CrowdStrike Falcon) periodically pulls updates from the URLhaus API to refresh its internal threat library. During this synchronization, the system queries the specific Mozi-tagged URLs listed in the Hunt package as part of a health check or data validation routine.
  • Filter/Exclusion: Exclude network traffic originating from the SIEM’s management IP addresses (e.g., 10.20.5.10) and the EDR management server FQDNs where the HTTP User-Agent string contains keywords like Splunk-HTTP, Sentinel-Aggregator, or CrowdStrike-Falcon.

• Scenario: Scheduled Software Update Scans by Endpoint Management Tools

  • Context: Enterprise patching solutions such as Microsoft Intune, SCCM (System Center Configuration Manager), or Ivanti Neurons run nightly scheduled jobs to verify the integrity of update repositories. These tools often probe known malicious URL lists to ensure their own scanning engines are correctly categorizing external resources before pushing updates to endpoints.
  • Filter/Exclusion: Create a rule exclusion for traffic generated by service accounts (e.g., svc-intune-updater, SCCM-HealthCheck) running on the Patch Management Server, specifically filtering out requests where the HTTP method is HEAD or GET and the destination port is 443 during maintenance windows (e.g., 02:00–04:00 UTC).

• Scenario: Admin Manual Verification via Browser Extensions

  • Context: Security analysts or IT administrators