URLhaus: Mozi Malicious URLs

Hunt Hypothesis

This detection rule identifies adversary activity involving the Mozi malware family by flagging network traffic to six known malicious URLs that facilitate command-and-control communication or payload delivery. A SOC team should proactively hunt for these indicators within Azure Sentinel to rapidly isolate compromised endpoints and prevent lateral movement before the malware establishes persistence on critical systems.

IOC Summary

Threat: Mozi Total URLs: 6 Active URLs: 6

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: Mozi
let malicious_domains = dynamic(["110.37.76.64", "115.57.199.189", "42.235.80.131", "61.53.75.206"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["110.37.76.64", "115.57.199.189", "42.235.80.131", "61.53.75.206"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

False Positive Scenarios for “URLhaus: Mozi Malicious URLs” Rule

• Scenario: Enterprise Antivirus Cloud Reputation Checks

  • Context: Endpoint protection suites like CrowdStrike Falcon, Microsoft Defender for Endpoint, or SentinelOne frequently perform background telemetry uploads to cloud reputation services. These agents often query known threat intelligence feeds (including URLhaus) to validate the safety of resources accessed by users, triggering a hit on Mozi-tagged URLs even when no user interaction occurred.
  • Suggested Filter: Exclude network traffic originating from specific service accounts or agent processes.
    • Filter Logic: Source Process Name IN ("FalconSensor.exe", "MsMpEng.exe", "SentinelOneAgent.exe") AND User Account IN ("SYSTEM", "LocalService").

• Scenario: Scheduled Security Information and Event Management (SIEM) Ingestion Jobs

  • Context: SIEM platforms such as Splunk, QRadar, or Microsoft Sentinel often run scheduled ingestion jobs that pull threat intelligence data from external APIs. When these systems query the URLhaus API to update their local threat libraries, they may generate traffic logs containing Mozi-tagged URLs, which appear as active malicious detections rather than passive data synchronization.
  • Suggested Filter: Exclude traffic generated by SIEM collector services running on dedicated management servers during off-peak maintenance windows.
    • Filter Logic: Source Host IN ("SIEM-Ingest-01", "QRadar-Collector") AND Time Window BETWEEN 02:00 AND 04:00 (Server Local Time).

• Scenario: Automated Browser-Based Compliance Scanning

  • Context: Compliance and vulnerability management tools like Qualys Cloud Agent, Tenable Nessus, or ServiceNow Security Workbench