This hunt hypothesis targets adversaries utilizing Mozi malware to conduct stealthy data exfiltration through encrypted command-and-control channels initiated by phishing campaigns. Proactive hunting in Azure Sentinel is critical to identify early-stage espionage activities and prevent the establishment of persistent access that could lead to significant sensitive information compromise.
Threat: Mozi Total URLs: 52 Active URLs: 52
| URL | Status | Threat | Date Added |
|---|---|---|---|
hxxp://182.116.89.39:56033/bin.sh | online | malware_download | 2026-08-03 |
hxxp://42.236.150.111:38647/i | online | malware_download | 2026-08-03 |
hxxp://123.4.142.146:41299/bin.sh | online | malware_download | 2026-08-03 |
hxxp://115.63.49.184:52595/bin.sh | online | malware_download | 2026-08-03 |
hxxp://37.52.141.118:33120/bin.sh | online | malware_download | 2026-08-03 |
hxxp://123.5.14.158:44855/i | online | malware_download | 2026-08-03 |
hxxp://115.55.240.192:56668/i | online | malware_download | 2026-08-03 |
hxxp://27.206.197.243:51375/i | online | malware_download | 2026-08-03 |
hxxp://182.113.227.205:41880/bin.sh | online | malware_download | 2026-08-03 |
hxxp://61.53.86.19:53348/i | online | malware_download | 2026-08-03 |
hxxp://61.53.86.19:53348/bin.sh | online | malware_download | 2026-08-03 |
hxxp://182.127.37.52:42129/bin.sh | online | malware_download | 2026-08-03 |
hxxp://222.141.137.226:55091/i | online | malware_download | 2026-08-03 |
hxxp://182.116.89.39:56033/i | online | malware_download | 2026-08-03 |
hxxp://42.235.93.19:51785/bin.sh | online | malware_download | 2026-08-03 |
hxxp://37.52.156.110:55715/bin.sh | online | malware_download | 2026-08-03 |
hxxp://182.113.38.58:57402/bin.sh | online | malware_download | 2026-08-03 |
hxxp://42.237.100.153:55957/i | online | malware_download | 2026-08-03 |
hxxp://112.248.127.94:37050/i | online | malware_download | 2026-08-03 |
hxxp://222.138.234.174:50719/i | online | malware_download | 2026-08-03 |
hxxp://123.4.142.146:41299/i | online | malware_download | 2026-08-03 |
hxxp://182.113.3.13:55170/i | online | malware_download | 2026-08-03 |
hxxp://182.121.10.250:38908/i | online | malware_download | 2026-08-03 |
hxxp://182.113.38.58:57402/i | online | malware_download | 2026-08-03 |
hxxp://42.239.188.54:48199/bin.sh | online | malware_download | 2026-08-03 |
// Hunt for DNS resolution of URLhaus malicious domains
// Threat: Mozi
let malicious_domains = dynamic(["42.235.93.19", "39.88.248.179", "42.237.100.153", "112.248.127.94", "182.121.10.250", "61.53.86.19", "125.43.230.120", "42.239.188.54", "115.63.49.184", "182.113.3.13", "115.50.148.113", "123.14.218.241", "27.206.197.243", "182.116.89.39", "222.138.234.174", "37.52.141.118", "115.55.240.192", "123.4.142.146", "182.113.38.58", "222.141.137.226", "42.236.150.111", "123.5.14.158", "182.127.37.52", "182.113.227.205", "37.52.156.110", "110.37.76.64"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc
// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["42.235.93.19", "39.88.248.179", "42.237.100.153", "112.248.127.94", "182.121.10.250", "61.53.86.19", "125.43.230.120", "42.239.188.54", "115.63.49.184", "182.113.3.13", "115.50.148.113", "123.14.218.241", "27.206.197.243", "182.116.89.39", "222.138.234.174", "37.52.141.118", "115.55.240.192", "123.4.142.146", "182.113.38.58", "222.141.137.226", "42.236.150.111", "123.5.14.158", "182.127.37.52", "182.113.227.205", "37.52.156.110", "110.37.76.64"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc
| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
Here are 4 specific false positive scenarios for the URLhaus: Mozi Malicious URLs detection rule, tailored for a legitimate enterprise environment:
Scenario: Automated Security Scanner Traffic
SourceIP IN [10.50.10.0/24] or specific hostnames like scanner-vm-01.corp.local).Scenario: Scheduled Cloud Backup & Sync Operations
UserPrincipalName CONTAINS 'svc-backup') or whitelist the destination domains associated with your primary cloud storage provider (e.g., DestinationDomain IN [*.office365.com, *.box.com]).Scenario: Software Update Mechanisms via Phishing Simulation Platforms