URLhaus: Mozi Malicious URLs

Hunt Hypothesis

This detection identifies adversary activity involving the Mozi malware family by flagging network traffic to three specific malicious URLs known for delivering ransomware payloads. A proactive hunt is essential in Azure Sentinel to rapidly isolate compromised endpoints and prevent lateral movement before the malware can encrypt critical assets or exfiltrate sensitive data.

IOC Summary

Threat: Mozi Total URLs: 3 Active URLs: 3

KQL: Url Dns Hunt

// Hunt for DNS resolution of URLhaus malicious domains
// Threat: Mozi
let malicious_domains = dynamic(["61.52.68.164", "219.156.105.15", "42.235.174.78"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc

KQL: Url Proxy Hunt

// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["61.52.68.164", "219.156.105.15", "42.235.174.78"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc

Required Data Sources

References

• URLhaus

False Positive Guidance

Here are specific false positive scenarios for the URLhaus: Mozi Malicious URLs detection rule, along with targeted filters and exclusions:

• Scenario: Security Team Manual Threat Hunting via URLhaus API

  • Context: SOC analysts or threat intelligence engineers manually query the urlhaus-api.abuse.ch endpoint to verify specific indicators of compromise (IOCs) using tools like PowerShell, Python scripts, or Splunk Add-on for URLhaus. These queries often return lists containing Mozi-tagged URLs as part of a broader dataset, triggering the rule even though no actual infection occurred on the host.
  • Suggested Filter/Exclusion: Create an exclusion based on the source process name matching python.exe, pwsh.exe, or specific threat hunting tools (e.g., Splunk-Add-on.exe). Additionally, filter out events where the user account belongs to a dedicated “ThreatIntel” or “SOC_Admin” security group.

• Scenario: Automated Vulnerability Scanning and Compliance Reporting

  • Context: Scheduled jobs running enterprise vulnerability scanners such as Tenable Nessus, Qualys, or Rapid7 InsightVM frequently crawl internal and external web resources to validate certificate chains and URL reputation. These tools often parse Mozi-tagged URLs during their discovery phase, generating network traffic that mimics a user browsing a malicious site.
  • Suggested Filter/Exclusion: Exclude events originating from known scanner service accounts (e.g., svc_nessus, qualys_agent) or filter by process path containing the installation directory of these specific tools. A time-based exclusion can also be applied if scans run only during off-hours (e.g., 02:00–06:00).

• Scenario: Endpoint Detection and Response (EDR) Telemetry Ingestion

  ---