This detection identifies adversary activity involving the Mozi malware family by flagging network traffic to known malicious URLs that facilitate command-and-control communication or payload delivery. Proactively hunting for these indicators in Azure Sentinel is critical because Mozi’s sophisticated evasion techniques require early identification of its web-based infection vectors to prevent lateral movement and data exfiltration before full compromise occurs.
Threat: Mozi Total URLs: 29 Active URLs: 29
| URL | Status | Threat | Date Added |
|---|---|---|---|
hxxp://59.103.116.68:54641/bin.sh | online | malware_download | 2026-08-09 |
hxxp://112.255.6.104:51842/i | online | malware_download | 2026-08-09 |
hxxp://182.124.41.91:59176/bin.sh | online | malware_download | 2026-08-09 |
hxxp://182.124.41.91:59176/i | online | malware_download | 2026-08-09 |
hxxp://182.127.26.190:34325/i | online | malware_download | 2026-08-09 |
hxxp://125.44.219.81:55457/bin.sh | online | malware_download | 2026-08-09 |
hxxp://119.184.29.187:45741/i | online | malware_download | 2026-08-09 |
hxxp://61.52.7.68:35582/bin.sh | online | malware_download | 2026-08-09 |
hxxp://27.217.3.109:54209/bin.sh | online | malware_download | 2026-08-09 |
hxxp://222.137.213.31:48901/i | online | malware_download | 2026-08-09 |
hxxp://110.37.12.8:38162/bin.sh | online | malware_download | 2026-08-09 |
hxxp://82.48.207.52:56706/i | online | malware_download | 2026-08-09 |
hxxp://115.52.179.220:43157/i | online | malware_download | 2026-08-09 |
hxxp://123.9.25.110:38551/i | online | malware_download | 2026-08-09 |
hxxp://42.227.134.211:38080/i | online | malware_download | 2026-08-09 |
hxxp://42.224.197.152:60373/bin.sh | online | malware_download | 2026-08-09 |
hxxp://42.224.197.152:60373/i | online | malware_download | 2026-08-09 |
hxxp://123.14.181.239:50468/i | online | malware_download | 2026-08-09 |
hxxp://42.230.35.149:47141/i | online | malware_download | 2026-08-09 |
hxxp://59.103.116.68:54641/i | online | malware_download | 2026-08-09 |
hxxp://115.58.171.191:59435/i | online | malware_download | 2026-08-09 |
hxxp://182.112.39.204:49245/i | online | malware_download | 2026-08-09 |
hxxp://115.55.9.151:44103/bin.sh | online | malware_download | 2026-08-09 |
hxxp://125.47.244.3:55442/bin.sh | online | malware_download | 2026-08-09 |
hxxp://222.134.172.2:44618/bin.sh | online | malware_download | 2026-08-09 |
// Hunt for DNS resolution of URLhaus malicious domains
// Threat: Mozi
let malicious_domains = dynamic(["82.48.207.52", "115.58.171.191", "182.127.26.190", "103.160.130.178", "123.9.25.110", "42.224.197.152", "115.55.29.170", "119.184.29.187", "123.14.181.239", "182.124.41.91", "112.255.6.104", "115.54.124.37", "125.47.244.3", "61.52.7.68", "115.52.179.220", "123.8.17.147", "42.230.35.149", "222.134.172.2", "115.55.9.151", "222.137.213.31", "110.37.12.8", "42.227.134.211", "59.103.116.68", "182.112.39.204", "125.44.219.81", "27.217.3.109"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses
| order by TimeGenerated desc
// Hunt for web traffic to URLhaus malicious domains
let malicious_domains = dynamic(["82.48.207.52", "115.58.171.191", "182.127.26.190", "103.160.130.178", "123.9.25.110", "42.224.197.152", "115.55.29.170", "119.184.29.187", "123.14.181.239", "182.124.41.91", "112.255.6.104", "115.54.124.37", "125.47.244.3", "61.52.7.68", "115.52.179.220", "123.8.17.147", "42.230.35.149", "222.134.172.2", "115.55.9.151", "222.137.213.31", "110.37.12.8", "42.227.134.211", "59.103.116.68", "182.112.39.204", "125.44.219.81", "27.217.3.109"]);
CommonSecurityLog
| where RequestURL has_any (malicious_domains) or DestinationHostName has_any (malicious_domains)
| project TimeGenerated, SourceIP, RequestURL, DestinationHostName, DeviceAction
| order by TimeGenerated desc
| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DnsEvents | Ensure this data connector is enabled |
Here are 4 specific false positive scenarios and corresponding exclusions for the URLhaus: Mozi Malicious URLs detection rule in an enterprise environment:
Scenario: Automated Security Scanner Crawls
Tenable Nessus Agent, Qualys Cloud Agent, or Rapid7 InsightVM and the destination URL matches the specific Mozi list.Scenario: Admin-Driven Software Update Checks
svc-admin-update or local admin users during business hours (08:00–18:00) where the HTTP method is GET and the response code is 200 OK.Scenario: Scheduled Data Backup and Sync Jobs