This hunt detects adversary activity involving the Mozi malware family by identifying network traffic to a curated set of 48 known malicious URLs that facilitate command-and-control communications and payload delivery. Proactively hunting for these indicators in Azure Sentinel is critical because Mozi’s high severity rating suggests an active threat capable of establishing persistent footholds, requiring immediate investigation before lateral movement or data exfiltration occurs.
Threat: Mozi Total URLs: 48 Active URLs: 48
| URL | Status | Threat | Date Added |
|---|---|---|---|
hxxp://123.12.82.26:56083/i | online | malware_download | 2026-08-02 |
hxxp://123.12.82.26:56083/bin.sh | online | malware_download | 2026-08-02 |
hxxp://115.49.200.35:52516/i | online | malware_download | 2026-08-02 |
hxxp://110.36.93.182:60247/i | online | malware_download | 2026-08-02 |
hxxp://182.126.80.129:35082/i | online | malware_download | 2026-08-02 |
hxxp://144.48.123.149:56728/i | online | malware_download | 2026-08-02 |
hxxp://39.88.248.179:44390/i | online | malware_download | 2026-08-02 |
hxxp://144.48.123.149:56728/bin.sh | online | malware_download | 2026-08-02 |
hxxp://182.117.112.129:42972/bin.sh | online | malware_download | 2026-08-02 |
hxxp://182.121.215.140:39105/i | online | malware_download | 2026-08-02 |
hxxp://110.37.76.64:55002/bin.sh | online | malware_download | 2026-08-02 |
hxxp://42.234.235.243:46833/i | online | malware_download | 2026-08-02 |
hxxp://222.139.205.153:48601/i | online | malware_download | 2026-08-02 |
hxxp://27.215.181.102:41996/i | online | malware_download | 2026-08-02 |
hxxp://125.47.59.129:36915/bin.sh | online | malware_download | 2026-08-02 |
hxxp://110.36.11.225:52662/bin.sh | online | malware_download | 2026-08-02 |
hxxp://61.53.201.115:57813/i | online | malware_download | 2026-08-02 |
hxxp://42.237.25.71:58345/i | online | malware_download | 2026-08-02 |
hxxp://115.63.245.110:42749/i | online | malware_download | 2026-08-02 |
hxxp://123.129.134.146:44202/i | online | malware_download | 2026-08-02 |
hxxp://42.226.71.40:52557/i | online | malware_download | 2026-08-02 |
hxxp://39.81.110.234:45926/bin.sh | online | malware_download | 2026-08-02 |
hxxp://27.215.181.102:41996/bin.sh | online | malware_download | 2026-08-02 |
hxxp://182.113.202.181:35968/i | online | malware_download | 2026-08-02 |
hxxp://115.63.49.184:52595/i | online | malware_download | 2026-08-02 |
// Hunt for DNS resolution of URLhaus malicious domains
// Threat: Mozi
let malicious_domains = dynamic(["182.117.112.129", "182.113.202.181", "110.37.76.64", "61.53.84.130", "39.88.248.179", "125.47.59.129", "112.248.102.20", "61.53.201.115", "42.234.235.243", "123.11.2.242", "144.48.123.149", "123.129.134.146", "110.36.93.182", "115.49.200.35", "39.81.110.234", "42.237.25.71", "222.139.205.153", "115.63.245.110", "110.36.11.225", "123.5.155.68", "123.12.82.26", "182.126.80.129", "182.121.215.140", "115.63.49.184", "42.226.71.40", "27.215.181.102", "115.48.151.106"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc
// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["182.117.112.129", "182.113.202.181", "110.37.76.64", "61.53.84.130", "39.88.248.179", "125.47.59.129", "112.248.102.20", "61.53.201.115", "42.234.235.243", "123.11.2.242", "144.48.123.149", "123.129.134.146", "110.36.93.182", "115.49.200.35", "39.81.110.234", "42.237.25.71", "222.139.205.153", "115.63.245.110", "110.36.11.225", "123.5.155.68", "123.12.82.26", "182.126.80.129", "182.121.215.140", "115.63.49.184", "42.226.71.40", "27.215.181.102", "115.48.151.106"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc
| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
Here are 3-5 specific false positive scenarios for the URLhaus: Mozi Malicious URLs detection rule, including targeted filters and exclusions:
Scenario: Automated Security Scanner Traffic
source_ip IN [10.50.1.10-10.50.1.20] OR hostname CONTAINS 'nessus-scanner').Scenario: Scheduled Endpoint Protection Updates
EXCLUDE IF process_name == 'CrowdStrikeService' AND hour BETWEEN 02:00 AND 04:00).Scenario: IT Admin Manual Threat Research