URLhaus: Mozi Malicious URLs

Hunt Hypothesis

This detection identifies adversary activity involving the Mozi malware family by monitoring network traffic against a curated list of nine known malicious URLs from URLhaus. A proactive hunt is essential in Azure Sentinel to rapidly isolate compromised endpoints and prevent lateral movement before attackers can establish persistence or exfiltrate sensitive data through these specific command-and-control channels.

IOC Summary

Threat: Mozi Total URLs: 9 Active URLs: 9

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: Mozi
let malicious_domains = dynamic(["182.118.244.55", "110.37.64.31", "182.121.204.65", "219.157.51.222", "182.116.38.123", "182.115.185.8", "123.12.229.234"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["182.118.244.55", "110.37.64.31", "182.121.204.65", "219.157.51.222", "182.116.38.123", "182.115.185.8", "123.12.229.234"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are 5 specific false positive scenarios for the URLhaus: Mozi Malicious URLs detection rule, along with recommended filters and exclusions tailored for an enterprise environment:

• Scenario: Scheduled Antivirus Definition Updates

  • Context: Enterprise endpoints running CrowdStrike Falcon or Microsoft Defender for Endpoint automatically query vendor update servers to download the latest Mozi-related threat intelligence feeds. These scheduled jobs often hit URLs that match the “Mozi” signature pattern due to shared infrastructure or naming conventions in the update repository.
  • Filter/Exclusion: Create a whitelist rule excluding traffic from specific internal IP ranges (e.g., 10.20.x.x) destined for known vendor update domains (e.g., *.crowdstrike.com, *.microsoft.com). Additionally, exclude events occurring during the defined maintenance window (e.g., 02:00–04:00 UTC) where these updates are triggered.

• Scenario: Admin-Driven Security Policy Deployment

  • Context: The SOC team uses Tenable Nessus or Qualys to push a new security policy containing Mozi-specific URL allow-lists to the fleet. During the deployment phase, management servers initiate outbound connections to validate these URLs against the central repository, triggering the detection rule as “malicious” despite being part of a legitimate configuration change.
  • Filter/Exclusion: Implement an exclusion based on the Source User attribute, filtering out traffic initiated by service accounts such as svc-qualys-deploy or admin-policy-bot. Alternatively, exclude events where the Process Name is identified as TenableAgent.exe or QualysPCClient.exe during policy push windows.

• Scenario: Cloud Backup and Archiving Jobs

  • Context: Automated backup solutions like **Veeam Backup